Apache Storm CVE-2026-82431

Exploitation requires three concurrent conditions: (1) org.apache.storm:storm-client version 3.0.0 through 3.0.x deployed with an active Nimbus instance; (2) the operator has configured nimbus.groups with at least one group entry intending to restrict cluster access, while nimbus.users is explicitly empty or unset; (3) the attacker holds valid Nimbus authentication credentials for any recognized principal regardless of group membership. The vulnerability does NOT affect deployments where nimbus.users is also populated (even partially), since a non-empty nimbus.users list causes group evaluation to proceed normally. The shipped default - both lists empty, meaning no access restriction - is also unaffected and unchanged. The bypass is entirely silent: no log line, configuration warning, or runtime indicator reveals that group restrictions are being ignored, preventing self-detection without reading this advisory.

No CVSS vector or EPSS score was provided in the input; all metric assessments below are independently derived from the advisory description. Real-world risk is significant within the specific affected deployment pattern but constrained by configuration prerequisites. The bypass only manifests when an operator has explicitly set nimbus.groups while leaving nimbus.users unset - a non-default but explicitly documented configuration. Default deployments (both lists empty, meaning no restriction) are unaffected. For vulnerable deployments the impact is severe: full user-level Nimbus operations are exposed, including topology submission, blob store file upload, and configuration retrieval, which together constitute effective cluster takeover capability. The silent failure mode (no log entries, no configuration warning) amplifies risk because affected operators cannot detect the misconfiguration without reading this advisory. The absence of any KEV listing and no public POC reduces immediate threat from opportunistic actors, but insider threat or compromised credentials within an organization relying solely on group-based restriction represent a realistic concern. CVSS interpretation: AV:N (Nimbus is a network thrift service), AC:H (requires specific non-default operator configuration), PR:L (valid authentication credentials required), S:U, C:H/I:H/A:H (full cluster operations).

An authenticated Nimbus user whose principal is not a member of any configured group connects to the cluster thrift API. Because SimpleACLAuthorizer returns a blanket permit when nimbus.users is empty, the user is granted full user-level access and submits a resource-exhausting or malicious topology, uploads rogue jars to the blob store, or calls getNimbusConf to extract cluster credentials or configuration. No public exploit code is available at time of analysis; exploitation requires valid credentials and knowledge of the configuration gap.