CVE-2026-84179

Name of the Vulnerable Software and Affected Versions Apache Storm versions prior to 3.1.0

Description The getTopologyPageInfo function merges the Nimbus daemon configuration with the topology configuration and returns the result without redaction in the topology conf field of TopologyPageInfo. This value is then copied verbatim into the configuration field of the API endpoints GET /api/v1/topology/{id} and the corresponding metrics endpoint. This allows users with read-only permissions, specifically those listed in topology.readonly.users or topology.readonly.groups under SimpleACLAuthorizer, to access sensitive daemon credentials. These credentials may include storm.zookeeper.auth.payload, keystore and truststore passwords for Thrift, Netty, and ZooKeeper TLS configurations, and any plugin keys denoting secrets.

Recommendations Upgrade to version 3.1.0. Remove any principal not trusted with cluster credentials from topology.readonly.users, topology.readonly.groups, topology.users, and topology.groups. Rotate the ZooKeeper authentication payload and any TLS keystore or truststore passwords that were accessible through the topology page.