CVE-2026-82433

/// Technical description

Description

`getNimbusConf` returned the complete daemon configuration without redaction after only a user-level

authorization check. Where the cluster is configured with them, that response includes

`storm.zookeeper.auth.payload` and the keystore and truststore passwords for the Thrift, Netty and

ZooKeeper TLS configuration. The project masks passwords elsewhere before display, so the omission here is

inconsistent rather than intended.

The UI endpoint `/api/v1/cluster/configuration` compounded this. It carried no `@AuthNimbusOp` annotation,

and the authorization filter treated a missing annotation as "no gate required" and returned immediately, so

the endpoint applied no per-user check at all and proxied the request under the UI daemon's own principal.

Any user able to pass `ui.filter` therefore received the full configuration, including principals that

Nimbus itself would have refused. 

Mitigation

Upgrade to 3.1.0, where credential-bearing values are masked before the configurati

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References