EUVD-2026-77482
GHSA-gp9q-jh3g-h72p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable single API call (AV:N/AC:L); requires topology read-only credentials (PR:L); exposes cluster secrets with no integrity or availability impact (C:H/I:N/A:N).
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
Articles & Coverage 1
AnalysisAI
The Storm UI topology REST endpoint (GET /api/v1/topology/{id}) in Apache Storm 3.0.0 returned a merged Nimbus daemon and topology configuration without credential redaction, exposing ZooKeeper authentication payloads and TLS keystore/truststore passwords to any principal holding topology read-only access. This privilege gap is significant because the dedicated getNimbusConf API already redacted these secrets and required elevated nimbus.users membership, yet the topology page - which merges in strictly more daemon state - was unprotected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) Apache Storm version 3.0.0 deployed with both Nimbus and Storm UI components; (2) the attacker must hold a valid principal listed in `topology.readonly.users`, `topology.readonly.groups`, `topology.users`, or `topology.groups` on at least one topology - unauthenticated exploitation is not possible; (3) the Storm cluster must have sensitive values such as `storm.zookeeper.auth.payload` or TLS keystore/truststore passwords present in the Nimbus daemon configuration (e.g., storm-cluster-auth.yaml) for those specific secrets to appear in the leaked response - clusters that have not configured ZooKeeper auth or TLS at the daemon level are unaffected for those specific keys, though any other daemon-level configuration key is still returned unredacted. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The Apache Security Team rated this 'important'. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Apache Storm 3.1.0, which masks credential-bearing values before serving any configuration over the Nimbus Thrift API, eliminating the disclosure at source for both the topology page and the metrics endpoint. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: immediately restrict network access to the Storm UI REST endpoint /api/v1/topology/{id} using firewall rules or reverse proxy authentication controls; rotate all ZooKeeper authentication credentials and TLS keystore/truststore passwords used by Apache Storm 3.0.0 clusters; audit authentication logs for any unauthorized API access patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today