CVE-2026-82433: Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level author
infovulnerability
A vulnerability in Apache Storm's `getNimbusConf` function exposed sensitive configuration data, including passwords for ZooKeeper (a distributed coordination service) and TLS encryption, because it performed inadequate authorization checks before returning the complete daemon configuration (the settings controlling the background service). The UI endpoint `/api/v1/cluster/configuration` made this worse by not checking user permissions at all, allowing any user to access these secrets.
Upgrade to version 3.1.0, where sensitive values are masked before the configuration is shared and all UI API endpoints must explicitly declare their authorization requirements. For users unable to upgrade immediately, place the UI behind an authenticating reverse proxy that blocks access to `/api/v1/cluster/configuration`, and rotate the ZooKeeper authentication payload and any TLS keystore or truststore passwords that may have been exposed.
EPSS: 0.0%
September 14, 2026
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-82433
First tracked: September 14, 2026 at 02:11 PM
Classified by LLM (prompt v3) · confidence: 95%