Apache Storm Nimbus versions >=3.0.0 and <3.1.0 retain the ZooKeeper authentication payload `storm.zookeeper.topology.auth.payload` in topology configurations served to users with read-only topology permissions. This credential is not read-only and allows write-capable access to cluster state elements such as worker heartbeats, backpressure, and error states. The vulnerability also involves logging of this credential in submission client INFO logs and SASL DEBUG logs, exposing it in log aggregation or support bundles. The issue is addressed in Apache Storm 3.1.0 by removing the payload from configurations served to read-only callers and ceasing its logging. Users unable to upgrade immediately are advised to rotate the credential, review logs and support bundles for exposure, and restrict read-only topology permissions to trusted principals.

An attacker with only read-only topology permissions can obtain the ZooKeeper credential that allows write access to critical cluster state data, enabling them to forge or remove worker heartbeats, backpressure, and error state information for the affected topology. This can disrupt cluster operations and potentially impact availability or correctness of topology execution. The exposure of this credential in logs further increases the risk of compromise. The vulnerability has a CVSS 4.0 score of 10.0 (critical), indicating a high-impact security flaw with network attack vector, no required privileges or user interaction, and high confidentiality, integrity, and availability impacts.

Upgrade Apache Storm Nimbus to version 3.1.0 or later, where the vulnerability is fixed by removing the ZooKeeper authentication payload from configurations served to read-only users and stopping its logging. For users who cannot upgrade immediately, rotate the `storm.zookeeper.topology.auth.payload` credential for existing topologies, thoroughly review logs and support bundles for exposure of the credential, and restrict read-only topology permissions to trusted principals only.