# CVE-2026-41081: Apache Storm's Improper Handling of TLS Client Authentication Failure Leads to Anonymous Principal Assignment

Source: https://junglewise.ai/threats/cve-2026-41081-apache-storm-s-improper-handling-of-tls-client-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-27  
License: CC BY 4.0 with a link back

CVE-2026-41081 · Severity: medium · CVSS 6.5 · Published 2026-04-27

Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm

Versions Affected: up to 2.8.7

Description: When TLS transport is enabled in Apache Storm without requiring client certificate authentication (the default configuration), the TlsTransportPlugin assigns a fallback principal (CN=ANONYMOUS) if no client certificate is presented or if certificate verification fails. The underlying SSLPeerUnverifiedException is caught and suppressed rather than rejecting the connection.

This fail-open behavior means an unauthenticated client can establish a TLS connection and receive a valid principal identity. If the configured authorizer (e.g., SimpleACLAuthorizer) does not explicitly deny access to CN=ANONYMOUS, this may result in unauthorized access to Storm services. The condition is logged at debug level only, reducing visibility in production.

Impact: Unauthenticated clients may be assigned a principal identity, potentially bypassing authorization in permissive or misconfigured environments.

Mitigation: Users should upgrade to 2.8.7 in which TLS authentication failures are handled in a fail-closed manner.

Users who cannot upgrade immediately should:
- Enable mandatory client certificate authentication (nimbus.thrift.tls.client.auth.required: true)
- Ensure authorization rules explicitly deny access to CN=ANONYMOUS
- Review all ACL configurations for implicit default-allow behavior

Technologies: [Apache Storm](https://junglewise.ai/threats/technologies/storm). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-41081 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41081 being exploited in the wild.

**How severe is CVE-2026-41081?** Medium severity, with a CVSS score of 6.5, published 27 April 2026.

**Which products and versions are affected?** org.apache.storm:storm-client (Maven) ECOSYSTEM:introduced=0,fixed=2.8.7.

**Is there a fix for CVE-2026-41081?** Yes. org.apache.storm:storm-client (Maven): upgrade to 2.8.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-41081?** Check whether you run Apache Storm or org.apache.storm:storm-client (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.storm:storm-client (Maven): upgrade to 2.8.7 or later

  ```sh
  # set org.apache.storm:storm-client to 2.8.7 in your pom.xml or build.gradle
  ```


## Affected products

- Apache Storm
- org.apache.storm:storm-client (Maven) ECOSYSTEM:introduced=0,fixed=2.8.7

## Identifiers

- CVE-2026-41081
- GHSA-j2q8-xx3q-8fqh

## Related threats

- [Apache Storm Nimbus information disclosure in worker placement](https://junglewise.ai/threats/cve-2026-94125-nimbus-returns-the-worker-placement-of-every-topology-running-on)
- [Apache Storm Logviewer symlink traversal in worker logs](https://junglewise.ai/threats/cve-2026-124495-when-workers-run-as-the-topology-owner-the-logviewer-serves)
- [Apache Storm arbitrary class instantiation in scheduler](https://junglewise.ai/threats/cve-2026-82440-description-nimbus-instantiates-the-class-named-by-a-topology-s)
- [Apache Storm unsafe deserialization in state serialization](https://junglewise.ai/threats/cve-2026-82436-description-defaultstateserializer-used-to-persist-and-restore)
- [Apache Storm CORS misconfiguration allows credential-based data exposure](https://junglewise.ai/threats/cve-2026-82438-apache-storm-cors-misconfiguration-allows-credential-based-data)