Quick answers
- Is CVE-2026-82434 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82434 being exploited in the wild.
- How severe is CVE-2026-82434?
- Medium severity, with a CVSS score of 6.5, published 14 September 2026.
- Which products and versions are affected?
- Apache Storm prior to 3.1.0.
- Is there a fix for CVE-2026-82434?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-82434 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-82434?
- Check whether you run Apache Storm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a credential exposure flaw in Apache Storm's handling of ZooKeeper authentication payloads. The `storm.zookeeper.topology.auth.payload` is deliberately retained in topology configuration to support worker operations, but Nimbus (the cluster master) served this configuration verbatim to any caller with read-only topology permissions. Additionally, the submission client and SASL handlers logged this payload at INFO and DEBUG levels respectively. An attacker with read-only topology view permissions or access to logs/support bundles can extract the ZooKeeper credential and use it to forge worker state (heartbeats, backpressure, errors) for targeted topologies, though not for write operations on assignments. The fix in version 3.1.0 removes the payload from configurations served to read-only callers and suppresses logging of the payload.
Affected products
- Apache Storm prior to 3.1.0
Timeline
- 2026-09-14: disclosed