The vulnerability arises because the getTopologyPageInfo API call merges the Nimbus daemon configuration with the topology's configuration and returns it without redacting sensitive credential information in the topology_conf field. This includes sensitive data such as storm.zookeeper.auth.payload, TLS keystore and truststore passwords, and plugin keys marked as secrets. Under the SimpleACLAuthorizer, users with read-only topology access (topology.readonly.users or topology.readonly.groups) can access these credentials, bypassing the more restrictive access controls applied to the dedicated cluster configuration API getNimbusConf. The vulnerability is addressed in Apache Storm Nimbus 3.1.0 by masking credential-bearing values before any configuration is served via the Nimbus API.

Unauthorized users with read-only topology access can obtain sensitive cluster credentials, including ZooKeeper authentication payloads and TLS keystore/truststore passwords. This exposure could lead to compromise of cluster security and unauthorized access to protected resources. The vulnerability does not require elevated privileges beyond read-only topology access but exposes highly sensitive configuration data.

Upgrade to Apache Storm Nimbus version 3.1.0 or later, where credential-bearing values are masked before configuration data is served via the Nimbus API. For users unable to upgrade immediately, remove any principals not fully trusted with cluster credentials from topology.readonly.users, topology.readonly.groups, topology.users, and topology.groups. Additionally, rotate the ZooKeeper authentication payload and any TLS keystore or truststore passwords that may have been exposed through the topology page.