CVE-2026-82434: Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payl
Summary
A vulnerability in Storm allows users with read-only permission to view a topology to access the ZooKeeper credential (a password-like token for accessing ZooKeeper, the system that manages Storm cluster state) that is stored in the topology configuration. This credential has write access, meaning someone who obtains it could forge or delete important cluster state data like worker heartbeats and error messages. Additionally, this credential was also accidentally logged in plain text in system logs and support bundles.
Solution / Mitigation
Upgrade to version 3.1.0, where the payload is removed from the configuration served to read-only callers and is no longer written to logs. For users unable to upgrade immediately, the source recommends rotating `storm.zookeeper.topology.auth.payload` for existing topologies, reviewing retained logs and support bundles for the credential value, and restricting read-only topology permissions to trusted principals only.
Vulnerability Details
EPSS: 0.0%
September 14, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-82434
First tracked: September 14, 2026 at 02:11 PM
Classified by LLM (prompt v3) · confidence: 95%