EUVD-2026-77524
GHSA-3p33-32v8-fg8j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible Thrift/REST APIs; low privilege floor (any cluster user or ui.filter passer); high confidentiality impact from credential disclosure; no integrity or availability effect.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
AnalysisAI
Two authorization and redaction failures in Apache Storm 3.0.0 expose credential-bearing cluster configuration to under-privileged or entirely ungated callers. The Nimbus getNimbusConf Thrift API serves the full daemon configuration-including ZooKeeper authentication payloads and TLS keystore and truststore passwords-after only a user-level authorization check, silently omitting the credential masking applied everywhere else in the product. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two distinct exploitation paths exist. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Vendor-rated moderate; no CVSS vector, EPSS score, or CISA KEV status is present in the input, so all risk metrics below are inferred from the advisory description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apache Storm 3.1.0, where credential-bearing configuration values are masked before being served by both Nimbus and the UI, and where every UI API endpoint is required to carry an explicit `@AuthNimbusOp` authorization declaration. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Apache Storm 3.0.0 deployments, confirm credential exposure by querying both the Nimbus getNimbusConf Thrift API and the /api/v1/cluster/configuration REST endpoint, and review access logs for suspicious API calls. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today