Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm Versions Affected: up to 2.8.7 Description: When TLS transport is enabled in Apache Storm without requiring client certificate authentication (the default configuration), the TlsTransportPlugin assigns a fallback principal (CN=ANONYMOUS) if no client certificate is presented or if certificate verification fails. The underlying SSLPeerUnverifiedException is caught and suppressed rather than rejecting the connection. This fail-open behavior means an unauthenticated client can establish a TLS connection and receive a valid principal identity. If the configured authorizer (e.g., SimpleACLAuthorizer) does not explicitly deny access to CN=ANONYMOUS, this may result in unauthorized access to Storm services. The condition is logged at debug level only, reducing visibility in production. Impact: Unauthenticated clients may be assigned a principal identity, potentially bypassing authorization in permissive or misconfigured environments. Mitigation: Users should upgrade to 2.8.7 in which TLS authentication failures are handled in a fail-closed manner. Users who cannot upgrade immediately should: - Enable mandatory client certificate authentication (nimbus.thrift.tls.client.auth.required: true) - Ensure authorization rules explicitly deny access to CN=ANONYMOUS - Review all ACL configurations for implicit default-allow behavior

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0414 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-41081:
    Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache     Storm

    Versions Affected: up to 2.8.7

    Description: When TLS transport is enabled in Apache Storm without requiring client certificate     authentication (the default configuration), the TlsTransportPlugin assigns a fallback principal     (CN=ANONYMOUS) if no client certificate is presented or if certificate verification fails. The underlying     SSLPeerUnverifiedException is caught and suppressed rather than rejecting the connection.

    This fail-open behavior means an unauthenticated client can establish a TLS connection and receive a valid     principal identity. If the configured authorizer (e.g., SimpleACLAuthorizer) does not explicitly deny     access to CN=ANONYMOUS, this may result in unauthorized access to Storm services. The condition is logged     at debug level only, reducing visibility in production.

    Impact: Unauthenticated clients may be assigned a principal identity, potentially bypassing authorization     in permissive or misconfigured environments.

    Mitigation: Users should upgrade to 2.8.7 in which TLS authentication failures are handled in a fail-     closed manner.

    Users who cannot upgrade immediately should:
    - Enable mandatory client certificate authentication (nimbus.thrift.tls.client.auth.required: true)
    - Ensure authorization rules explicitly deny access to CN=ANONYMOUS
    - Review all ACL configurations for implicit default-allow behavior

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache
    Storm Versions Affected: up to 2.8.7 Description: When TLS transport is enabled in Apache Storm without
    requiring client certificate authentication (the default configuration), the TlsTransportPlugin assigns a
    fallback principal (CN=ANONYMOUS) if no client certificate is presented or if certificate verification
    fails. The underlying SSLPeerUnverifiedException is caught and suppressed rather than rejecting the
    connection. This fail-open behavior means an unauthenticated client can establish a TLS connection and
    receive a valid principal identity. If the configured authorizer (e.g., SimpleACLAuthorizer) does not
    explicitly deny access to CN=ANONYMOUS, this may result in unauthorized access to Storm services. The
    condition is logged at debug level only, reducing visibility in production. Impact: Unauthenticated
    clients may be assigned a principal identity, potentially bypassing authorization in permissive or
    misconfigured environments. Mitigation: Users should upgrade to 2.8.7 in which TLS authentication failures
    are handled in a fail-closed manner. Users who cannot upgrade immediately should: - Enable mandatory
    client certificate authentication (nimbus.thrift.tls.client.auth.required: true) - Ensure authorization
    rules explicitly deny access to CN=ANONYMOUS - Review all ACL configurations for implicit default-allow
    behavior (CVE-2026-41081)

ID	Name	Product	Family	Severity
319748	TencentOS Server 4: storm (TSSA-2026:0414)	Nessus	Tencent Local Security Checks	medium
441261	SCA: security update for org.apache.storm:storm-client (GHSA-j2q8-xx3q-8fqh)	Tenable Cloud Security	SCA Checks	medium
441261	SCA: security update for org.apache.storm:storm-client (GHSA-j2q8-xx3q-8fqh)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-41081

medium

Tenable Plugins

medium

medium

medium