PT-2026-35414 · Apache · Apache Storm

K + 1 · Published 2026-04-27 · Updated 2026-04-28 · CVE-2026-41081

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Storm versions prior to 2.8.7

Description When TLS transport is enabled without requiring client certificate authentication, the TlsTransportPlugin assigns a fallback principal (CN=ANONYMOUS) if no client certificate is presented or if verification fails. This occurs because the SSLPeerUnverifiedException is caught and suppressed instead of rejecting the connection. This fail-open behavior allows unauthenticated clients to establish a TLS connection and receive a valid principal identity. If the configured authorizer, such as SimpleACLAuthorizer, does not explicitly deny access to CN=ANONYMOUS, it may lead to unauthorized access to services. This condition is only logged at the debug level, which limits visibility in production environments.

Recommendations Update to version 2.8.7. Enable mandatory client certificate authentication by setting nimbus.thrift.tls.client.auth.required to true. Ensure authorization rules explicitly deny access to CN=ANONYMOUS. Review all ACL configurations for implicit default-allow behavior.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-41081

GHSA-J2Q8-XX3Q-8FQH

Affected Products

Apache Storm

References · 7

• https://osv.dev/vulnerability/GHSA-j2q8-xx3q-8fqh · Vendor Advisory
• https://lists.apache.org/thread/plxx5l29dvplk5rwzdcq53rdfl6v4gs8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41081 · Security Note
• https://github.com/apache/storm · Note
• http://openwall.com/lists/oss-security/2026/04/25/3 · Note
• https://twitter.com/oss_security/status/2048947848662651171 · Twitter Post
• https://twitter.com/CVEnew/status/2048852171320336871 · Twitter Post