« Volver al listado

CVE-2026-82431

Estado: AplazadaCrítica (9.8)—

Description

`SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty, before `nimbus.groups` was considered. An operator who restricted cluster access by group alone, leaving `nimbus.users` unset, therefore received no restriction at all: every authenticated principal was permitted every user-level operation, including `submitTopology`, `beginFileUpload` and `getNimbusConf`.

`docs/SECURITY.md` presents `nimbus.groups` as a supported way to lock down a cluster, so a deployment following the documentation could believe it was restricted while it was not. The failure is silent; nothing in the logs or the configuration indicates that the group list is being ignored.

Leer descripción completaMostrar menos

Both lists left empty continues to mean that no restriction is configured, which is the shipped default and is unchanged.

Mitigation

Upgrade to 3.1.0, where `nimbus.groups` is evaluated whether or not `nimbus.users` is set.

Users who cannot upgrade immediately should additionally populate `nimbus.users` with the intended principals, since a non-empty user list causes the group list to be evaluated on affected versions. Operators should review Nimbus access logs for operations by principals outside the intended groups.

Note that after upgrading, a cluster configured with `nimbus.groups` alone becomes restrictive for the first time. This includes `NimbusClient`, which calls `getLeader` on every connection, so clients outside the configured groups will begin to be refused.

Credit

The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de lógica en autorización (CWE-863) en Storm expuesto en red sin autenticación previa (AV:N/PR:N/UI:N) que permite operaciones administrativas no autorizadas: submitTopology, getNimbusConf, fileUpload; acceso a datos de configuración confidencial e impacto de disponibilidad.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser TrainingUser Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Apache — StormAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-82431",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-82431",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-14T20:01:33.385522Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Storm Client",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0",
              "lessThan": "3.1.0",
              "versionType": "semver"
            }
          ],
          "packageName": "org.apache.storm:storm-client",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-09-14T15:17:10.053",
  "references": [
    {
      "url": "https://lists.apache.org/thread/s335qxb6woqb35ho3fpq7toytsz1gpts",
      "source": "security@apache.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/09/13/11",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Description\n\n`SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty,\nbefore `nimbus.groups` was considered. An operator who restricted cluster access by group alone, leaving\n`nimbus.users` unset, therefore received no restriction at all: every authenticated principal was permitted\nevery user-level operation, including `submitTopology`, `beginFileUpload` and `getNimbusConf`.\n\n`docs/SECURITY.md` presents `nimbus.groups` as a supported way to lock down a cluster, so a deployment\nfollowing the documentation could believe it was restricted while it was not. The failure is silent; nothing\nin the logs or the configuration indicates that the group list is being ignored.\n\nBoth lists left empty continues to mean that no restriction is configured, which is the shipped default and\nis unchanged.\n\nMitigation\n\nUpgrade to 3.1.0, where `nimbus.groups` is evaluated whether or not `nimbus.users` is set.\n\nUsers who cannot upgrade immediately should additionally populate `nimbus.users` with the intended\nprincipals, since a non-empty user list causes the group list to be evaluated on affected versions.\nOperators should review Nimbus access logs for operations by principals outside the intended groups.\n\nNote that after upgrading, a cluster configured with `nimbus.groups` alone becomes restrictive for the first\ntime. This includes `NimbusClient`, which calls `getLeader` on every connection, so clients outside the\nconfigured groups will begin to be refused.\n\nCredit\n\nThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm."
    }
  ],
  "lastModified": "2026-09-14T20:58:48.430",
  "sourceIdentifier": "security@apache.org"
}