EUVD-2026-25848Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Exploitation requires two independent out-of-attacker-control conditions - TLS without mTLS and a permissive authorizer - warranting AC:H over the NVD-assigned AC:L.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm
Versions Affected: up to 2.8.7
Description: When TLS transport is enabled in Apache Storm without requiring client certificate authentication (the default configuration), the TlsTransportPlugin assigns a fallback principal (CN=ANONYMOUS) if no client certificate is presented or if certificate verification fails. The underlying SSLPeerUnverifiedException is caught and suppressed rather than rejecting the connection.
This fail-open behavior means an unauthenticated client can establish a TLS connection and receive a valid principal identity. If the configured authorizer (e.g., SimpleACLAuthorizer) does not explicitly deny access to CN=ANONYMOUS, this may result in unauthorized access to Storm services. The condition is logged at debug level only, reducing visibility in production.
Impact: Unauthenticated clients may be assigned a principal identity, potentially bypassing authorization in permissive or misconfigured environments.
Mitigation: Users should upgrade to 2.8.7 in which TLS authentication failures are handled in a fail-closed manner.
Users who cannot upgrade immediately should:
- Enable mandatory client certificate authentication (nimbus.thrift.tls.client.auth.required: true)
- Ensure authorization rules explicitly deny access to CN=ANONYMOUS
- Review all ACL configurations for implicit default-allow behavior
AnalysisAI
Apache Storm's TlsTransportPlugin silently assigns the principal CN=ANONYMOUS to unauthenticated TLS clients when client certificate authentication is not enforced - the default configuration - allowing unauthenticated network principals to interact with Storm services wherever the authorizer does not explicitly deny anonymous access. The fail-open behavior stems from suppressing SSLPeerUnverifiedException rather than rejecting the connection, and the condition is logged at debug level only, leaving the bypass invisible in most production monitoring setups. No public exploit has been identified and EPSS is 0.04% (11th percentile), but SSVC rates the vulnerability as automatable with partial technical impact, meaning tooling could systematically probe exposed clusters for permissive authorizer configurations.
Technical ContextAI
Apache Storm is a distributed, real-time stream-processing framework whose inter-component communication is secured via an optional TLS transport layer implemented through the TlsTransportPlugin. When TLS is enabled but mutual TLS is not enforced (nimbus.thrift.tls.client.auth.required defaults to false), the plugin is designed to fall back gracefully - however, it catches SSLPeerUnverifiedException and assigns a hardcoded fallback principal (CN=ANONYMOUS) rather than terminating the connection. Authorization decisions are then delegated to an external authorizer such as SimpleACLAuthorizer, which operates on the assigned principal. The root cause is CWE-287 (Improper Authentication): the system accepts an unverified identity as a valid authenticated entity. The affected component is identified via CPE as cpe:2.3:a:apache_software_foundation:apache_storm_client:*:*:*:*:*:*:*:*, covering all versions prior to 2.8.7 per EUVD-2026-25848.
RemediationAI
The primary remediation is upgrading to Apache Storm 2.8.7, which changes TLS authentication failure handling from fail-open to fail-closed, rejecting connections where certificate verification fails. The vendor advisory is at https://lists.apache.org/thread/plxx5l29dvplk5rwzdcq53rdfl6v4gs8. For deployments that cannot upgrade immediately, three layered compensating controls should be applied in combination. First, enable mandatory client certificate authentication by setting nimbus.thrift.tls.client.auth.required: true in the Storm configuration - this prevents unauthenticated TLS connections entirely but requires provisioning and distributing valid client certificates to all legitimate Storm clients before enabling, or legitimate clients will also be rejected. Second, explicitly add a deny rule for the CN=ANONYMOUS principal in all authorizer ACL configurations (e.g., SimpleACLAuthorizer) - this prevents the anonymous principal from accessing any Storm service even if assigned, but does not fix the underlying fail-open behavior and may need to be re-verified after any ACL change. Third, audit all existing ACL configurations for implicit default-allow entries that could inadvertently grant access to unknown or fallback principals. Additionally, raising TLS handshake failure log events from debug to warn level improves detection visibility while awaiting the patch.
More in Apache Storm Client
View allSame weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today