Apache Storm Client versions up to 2.8.7 exhibit a vulnerability (CVE-2026-41081) due to improper handling of TLS client authentication failures. When TLS is enabled without requiring client certificates (default setting), the TlsTransportPlugin assigns a fallback principal CN=ANONYMOUS if no client certificate is presented or verification fails. Instead of rejecting the connection, the SSLPeerUnverifiedException is caught and suppressed, allowing unauthenticated clients to connect with a valid principal identity. If the authorization configuration does not explicitly deny access to CN=ANONYMOUS, unauthorized access to Storm services may occur. The issue is logged only at debug level, reducing detection likelihood. The vulnerability is fixed in Apache Storm 2.8.7 by enforcing fail-closed behavior on TLS authentication failures. Users unable to upgrade immediately should enable mandatory client certificate authentication and ensure ACLs deny CN=ANONYMOUS access.

Unauthenticated clients can be assigned a valid principal identity (CN=ANONYMOUS) due to fail-open TLS authentication handling, potentially bypassing authorization controls in permissive or misconfigured environments. This may lead to unauthorized access to Apache Storm services if authorization rules do not explicitly deny the anonymous principal. The vulnerability reduces the effectiveness of TLS client authentication and weakens access control enforcement.

A fix is available in Apache Storm version 2.8.7, which handles TLS authentication failures in a fail-closed manner. Users should upgrade to this version to fully remediate the issue. For those unable to upgrade immediately, it is recommended to enable mandatory client certificate authentication by setting nimbus.thrift.tls.client.auth.required to true, explicitly deny access to the CN=ANONYMOUS principal in authorization rules, and review all ACL configurations to avoid implicit default-allow permissions. These steps help mitigate unauthorized access risks until the official fix is applied.