Follow @Openwall on Twitter for new release announcements and other news
[<prev] [day] [month] [year] [list] 
Message-ID: <14bcc13f-ca20-1432-c2c4-d090c459f633@apache.org>
Date: Wed, 11 Nov 2026 02:08:44 +0000
From: Rui Abreu <rabreu@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-124496: Apache Storm: DRPC HTTP doAsUser bypasses the
 impersonation authorizer 

Severity: low 

Affected versions:

- Apache Storm (org.apache.storm:storm-server) 3.0.0 before 3.2.0

Description:

The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue.

Credit:

Javier García Herrera (finder)

References:

https://storm.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-124496

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.