The vulnerability arises because SimpleACLAuthorizer returns early when the nimbus.users list is empty, ignoring the nimbus.groups list. Consequently, if an operator configures access restrictions only via nimbus.groups and leaves nimbus.users unset, all authenticated principals are granted unrestricted user-level operations such as submitTopology, beginFileUpload, and getNimbusConf. This behavior contradicts the documented security model and is silent with no log indications. The default configuration with both lists empty remains unrestricted as before. The fix in Apache Storm 3.1.0 ensures nimbus.groups is evaluated even if nimbus.users is empty, restoring intended access controls.

Any authenticated user can bypass group-based access restrictions if nimbus.users is empty and only nimbus.groups is configured, allowing unauthorized execution of sensitive operations on the cluster. This undermines cluster security by permitting actions that should be restricted to specific groups. The vulnerability does not affect configurations where nimbus.users is populated or both lists are empty (default unrestricted).

Upgrade to Apache Storm version 3.1.0 or later, where the authorization logic correctly evaluates nimbus.groups regardless of nimbus.users. For users unable to upgrade immediately, populate the nimbus.users list with intended principals to ensure group restrictions are enforced. Additionally, review Nimbus access logs for any operations performed by principals outside the intended groups to detect potential unauthorized access. After upgrading, be aware that clusters configured with only nimbus.groups will enforce restrictions for the first time, potentially denying access to clients outside those groups.