CVE-2026-82431: Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty
Summary
A security flaw in `SimpleACLAuthorizer` (a component that controls who can access a system) caused it to skip checking group-based access restrictions when the `nimbus.users` setting was empty, leaving the cluster completely open to any authenticated user. This was especially dangerous because the official documentation presented using `nimbus.groups` alone as a valid way to secure the system, so operators following best practices were unknowingly leaving their clusters unprotected.
Solution / Mitigation
Upgrade to version 3.1.0, where `nimbus.groups` is evaluated regardless of whether `nimbus.users` is set. For users unable to upgrade immediately, the source recommends populating `nimbus.users` with intended principals as a temporary workaround, since a non-empty user list causes the group list to be evaluated on affected versions. Operators should also review Nimbus access logs for operations by principals outside the intended groups.
Vulnerability Details
EPSS: 0.0%
September 14, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-82431
First tracked: September 14, 2026 at 02:11 PM
Classified by LLM (prompt v3) · confidence: 95%