Detections
Analytics

SCA: security update for org.apache.storm:storm-client (GHSA-j2q8-xx3q-8fqh)

medium Tenable Self-Hosted Container Security Plugin ID 441261

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache
 Storm Versions Affected: up to 2.8.7 Description: When TLS transport is enabled in Apache Storm without
 requiring client certificate authentication (the default configuration), the TlsTransportPlugin assigns a
 fallback principal (CN=ANONYMOUS) if no client certificate is presented or if certificate verification
 fails. The underlying SSLPeerUnverifiedException is caught and suppressed rather than rejecting the
 connection. This fail-open behavior means an unauthenticated client can establish a TLS connection and
 receive a valid principal identity. If the configured authorizer (e.g., SimpleACLAuthorizer) does not
 explicitly deny access to CN=ANONYMOUS, this may result in unauthorized access to Storm services. The
 condition is logged at debug level only, reducing visibility in production. Impact: Unauthenticated
 clients may be assigned a principal identity, potentially bypassing authorization in permissive or
 misconfigured environments. Mitigation: Users should upgrade to 2.8.7 in which TLS authentication failures
 are handled in a fail-closed manner. Users who cannot upgrade immediately should: - Enable mandatory
 client certificate authentication (nimbus.thrift.tls.client.auth.required: true) - Ensure authorization
 rules explicitly deny access to CN=ANONYMOUS - Review all ACL configurations for implicit default-allow
 behavior (CVE-2026-41081)

Solution

Update the org.apache.storm:storm-client library and its related packages to version 2.8.7 or later.

See Also

https://github.com/advisories/GHSA-j2q8-xx3q-8fqh

Plugin Details

Severity: Medium

ID: 441261

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 5/6/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.1

Percentile: 7.71

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-41081

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/27/2026

Vulnerability Publication Date: 4/27/2026

Reference Information

CVE: CVE-2026-41081

cwe: CWE-287