AEGLIX vulnerability intelligence
CVE-2026-41081
MEDIUM · CVSS 6.5 · Analyzed
Published: 2026-04-27 · Updated: 2026-10-26 · Source: NVD
Stored catalog record
Source record retrieved 2026-10-28T10:19:43.579338+00:00. Scheduled imports handle updates; this page does not assert that the provider was queried just now.
Vulnerability overview
Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm Versions Affected: up to 2.8.7 Description: When TLS transport is enabled in Apache Storm without requiring client certificate authentication (the default configuration), the TlsTransportPlugin assigns a fallback principal (CN=ANONYMOUS) if no client certificate is presented or if certificate verification fails. The underlying SSLPeerUnverifiedException is caught and suppressed rather than rejecting the connection. This fail-open behavior means an unauthenticated client can establish a TLS connection and receive a valid principal identity. If the configured authorizer (e.g., SimpleACLAuthorizer) does not explicitly deny access to CN=ANONYMOUS, this may result in unauthorized access to Storm services. The condition is logged at debug level only, reducing visibility in production. Impact: Unauthenticated clients may be assigned a principal identity, potentially bypassing authorization in permissive or misconfigured environments. Mitigation: Users should upgrade to 2.8.7 in which TLS authentication failures are handled in a fail-closed manner. Users who cannot upgrade immediately should: - Enable mandatory client certificate authentication (nimbus.thrift.tls.client.auth.required: true) - Ensure authorization rules explicitly deny access to CN=ANONYMOUS - Review all ACL configurations for implicit default-allow behavior
Patch review priority
Assess exposure and vendor guidance
- No higher-priority signal is available in the current stored evidence.
FIRST EPSS: 0.29% · percentile 21.1 · score date 2026-10-27.
EPSS estimates probability of exploitation in the next 30 days. It does not measure your exposure or prove exploitation. The elevated threshold is 10%; CISA KEV takes precedence. About FIRST EPSS ↗
Severity and scoring
- CVSS score
- 6.5 · MEDIUM
- CVSS version
- 3.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-287
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Not listed in the CISA catalog retrieved for this record. This does not establish that exploitation has not occurred.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
cpe:2.3:a:apache:storm:*:*:*:*:*:*:*:*
Before (exclusive): 2.8.7
These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.
Advisories and references
- https://lists.apache.org/thread/plxx5l29dvplk5rwzdcq53rdfl6v4gs8
Mailing List · Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/04/25/3
Mailing List · Third Party Advisory