https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 22:44:41 +0000 https://cve.radiocsirt.org/vuln/cve-2026-41081 <p><strong>Affected:</strong> Apache Software Foundation Apache Storm Client</p> <p>Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm</p> <p>Versions Affected: up to 2.8.7</p> <p>Description: When TLS transport is enabled in Apache Storm without requiring client certificate authentication (the default configuration), the TlsTransportPlugin assigns a fallback principal (CN=ANONYMOUS) if no client certificate is presented or if certificate verification fails. The underlying SSLPeerUnverifiedException is caught and suppressed rather than rejecting the connection.</p> <p>This fail-open behavior means an unauthenticated client can establish a TLS connection and receive a valid principal identity. If the configured authorizer (e.g., SimpleACLAuthorizer) does not explicitly deny access to CN=ANONYMOUS, this may result in unauthorized access to Storm services. The condition is logged at debug level only, reducing visibility in production.</p> <p>Impact: Unauthenticated clients may be assigned a principal identity, potentially bypassing authorization in permissive or misconfigured environments.</p> <p>Mitigation: Users should upgrade to 2.8.7 in which TLS authentication failures are handled in a fail-closed manner.</p> <p>Users who cannot upgrade immediately should: - Enable mandatory client certificate authentication (nimbus.thrift.tls.client.auth.required: true) - Ensure authorization rules explicitly deny access to CN=ANONYMOUS - Review all ACL configurations for implicit default-allow behavior</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Storm Client</p> <p>Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm</p> <p>Versions Affected: up to 2.8.7</p> <p>Description: When TLS transport is enabled in Apache Storm without requiring client certificate authentication (the default configuration), the TlsTransportPlugin assigns a fallback principal (CN=ANONYMOUS) if no client certificate is presented or if certificate verification fails. The underlying SSLPeerUnverifiedException is caught and suppressed rather than rejecting the connection.</p> <p>This fail-open behavior means an unauthenticated client can establish a TLS connection and receive a valid principal identity. If the configured authorizer (e.g., SimpleACLAuthorizer) does not explicitly deny access to CN=ANONYMOUS, this may result in unauthorized access to Storm services. The condition is logged at debug level only, reducing visibility in production.</p> <p>Impact: Unauthenticated clients may be assigned a principal identity, potentially bypassing authorization in permissive or misconfigured environments.</p> <p>Mitigation: Users should upgrade to 2.8.7 in which TLS authentication failures are handled in a fail-closed manner.</p> <p>Users who cannot upgrade immediately should: - Enable mandatory client certificate authentication (nimbus.thrift.tls.client.auth.required: true) - Ensure authorization rules explicitly deny access to CN=ANONYMOUS - Review all ACL configurations for implicit default-allow behavior</p> https://cve.radiocsirt.org/vuln/cve-2026-41081