CVE-2026-124496

UNKNOWN 0.0

Apache Storm: DRPC HTTP doAsUser bypasses the impersonation authorizer

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue.

CWE	CWE-863
Vendor	apache software foundation
Product	apache storm
Published	Nov 11, 2026
Last Updated	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache storm

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache storm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Storm

3.0.0 < 3.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/z8r5mxcpfgklq820j8krk8ozqxgqdhtr openwall.com: http://www.openwall.com/lists/oss-security/2026/11/11/5

Credits

Javier García Herrera