https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 07:12:37 +0000 https://vulnerability.circl.lu/vuln/cve-2026-82433 <p><strong>Affected:</strong> Apache Software Foundation Apache Storm Nimbus, Apache Software Foundation Apache Storm UI</p> <p>Description</p> <p>`getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes `storm.zookeeper.auth.payload` and the keystore and truststore passwords for the Thrift, Netty and ZooKeeper TLS configuration. The project masks passwords elsewhere before display, so the omission here is inconsistent rather than intended.</p> <p>The UI endpoint `/api/v1/cluster/configuration` compounded this. It carried no `@AuthNimbusOp` annotation, and the authorization filter treated a missing annotation as &#34;no gate required&#34; and returned immediately, so the endpoint applied no per-user check at all and proxied the request under the UI daemon&#39;s own principal. Any user able to pass `ui.filter` therefore received the full configuration, including principals that Nimbus itself would have refused.</p> <p>Mitigation</p> <p>Upgrade to 3.1.0, where credential-bearing values are masked before the configuration is served and where every UI API endpoint must declare its authorization explicitly.</p> <p>Users who cannot upgrade immediately should place the UI behind an authenticating reverse proxy that restricts `/api/v1/cluster/configuration`, and should rotate the ZooKeeper authentication payload and any TLS keystore or truststore passwords that were reachable through it.</p> <p>Credit</p> <p>The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Storm Nimbus, Apache Software Foundation Apache Storm UI</p> <p>Description</p> <p>`getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes `storm.zookeeper.auth.payload` and the keystore and truststore passwords for the Thrift, Netty and ZooKeeper TLS configuration. The project masks passwords elsewhere before display, so the omission here is inconsistent rather than intended.</p> <p>The UI endpoint `/api/v1/cluster/configuration` compounded this. It carried no `@AuthNimbusOp` annotation, and the authorization filter treated a missing annotation as &#34;no gate required&#34; and returned immediately, so the endpoint applied no per-user check at all and proxied the request under the UI daemon&#39;s own principal. Any user able to pass `ui.filter` therefore received the full configuration, including principals that Nimbus itself would have refused.</p> <p>Mitigation</p> <p>Upgrade to 3.1.0, where credential-bearing values are masked before the configuration is served and where every UI API endpoint must declare its authorization explicitly.</p> <p>Users who cannot upgrade immediately should place the UI behind an authenticating reverse proxy that restricts `/api/v1/cluster/configuration`, and should rotate the ZooKeeper authentication payload and any TLS keystore or truststore passwords that were reachable through it.</p> <p>Credit</p> <p>The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p> https://vulnerability.circl.lu/vuln/cve-2026-82433