EUVD-2026-77521
GHSA-6fmw-8rj9-p9pg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects required read-only authentication; C:H for full ZK credential disclosure; I:L and A:L for bounded write access to heartbeat/error state only.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
5Description PRE-NVD
AnalysisAI
ZooKeeper credential disclosure in Apache Storm 3.0.0 exposes storm.zookeeper.topology.auth.payload through two independent channels: Nimbus serves the full topology configuration verbatim to any caller holding read-only permissions, and the submission client logs the same payload at INFO level on every submission while SASL handlers emit it at DEBUG. An authenticated user with only read-only topology view rights can recover the ZooKeeper write credential and use it to forge or suppress worker heartbeats, backpressure, and error state for the affected topology, or indirectly obtain it via log aggregation pipelines or support bundles. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation via the Nimbus API requires: (1) ZooKeeper authentication must be configured in the Storm cluster (i.e., `storm.zookeeper.topology.auth.payload` is set and non-empty); (2) the attacker must hold a valid Storm credential with at least read-only topology permissions for the target topology; (3) direct or proxied network access to the Nimbus Thrift API port. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS score is absent from available data, requiring full independent assessment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade both org.apache.storm:storm-server and org.apache.storm:storm-client to version 3.1.0, where Nimbus strips `storm.zookeeper.topology.auth.payload` from configuration responses served to read-only callers and the logging of the credential is removed from both the submission client (INFO) and SASL handlers (DEBUG). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Apache Storm 3.0.0 deployments and catalog which users or roles have read-only topology access permissions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today