A critical authorization bypass vulnerability in Apache Storm allows authenticated users to perform restricted operations if cluster security is configured solely through group permissions.

The vulnerability exists in the SimpleACLAuthorizer component, which incorrectly returns early when the nimbus.users configuration is empty, effectively ignoring the nimbus.groups security policy. This flaw allows any authenticated principal to execute sensitive commands, such as submitting topologies or accessing configurations, despite administrative attempts to restrict access via group membership.

The potential for unauthorized execution of administrative commands poses a severe risk to cluster integrity and data confidentiality. With a CVSS score of 9.8, this flaw enables attackers to gain full control over topologies and system configurations, potentially leading to total system compromise or unauthorized data exfiltration.

Immediate Action: Upgrade to Apache Storm version 3.1.0, where the authorization logic correctly evaluates group memberships regardless of the user list configuration.

Proactive Monitoring: Review Nimbus access logs for any operations performed by unauthorized principals or users outside of defined groups to identify potential past exploitation.

Compensating Controls: For deployments unable to upgrade immediately, populate the nimbus.users field with authorized principals, as the presence of a non-empty user list forces the authorization engine to correctly evaluate the group list.

Public Exploit Available: Unknown

Given the critical nature of this authorization bypass, organizations must prioritize the transition to version 3.1.0. If an immediate upgrade is not feasible, the provided configuration workaround must be implemented instantly to ensure access control policies are effectively enforced.