Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-82434
By Roy Kalfon |
14 September 2026
CVE-2026-82434 – Apache Storm leaks ZooKeeper auth payload to read-only topology viewers and logs
In Apache Storm, when ZooKeeper auth is enabled, Nimbus served storm.zookeeper.topology.auth.payload verbatim to callers with read-only topology permissions, exposing a non-read-only ZooKeeper credential. The leaked credential can forge/remove cluster state (worker heartbeats, backpressure, error state). Client/SASL handlers also logged the payload. Affects `3.0.0–