CVE-2026-124496: Apache The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer
This Apache advisory covers CVE-2026-124496. Related products: Apache Storm.
- CVE-2026-124496
Key facts
- Vendor rating
- Low
- Weakness
- CWE-863 Incorrect Authorization
- CISA KEV
- Not listed (catalogue checked )
- Versions named
- Apache Storm 3.0.0 before 3.2.0
- Fixed in
- 3.2.0
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Related products & platforms
Description
The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user.
Users are recommended to upgrade to version 3.2.0, which fixes the issue.
Affected product named by the advisory: Apache Storm.
Text from the source record.
- Apache Storm 3.0.0 before 3.2.0
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2026-124496
Upgrade to a fixed release named by Apache:
- 3.2.0
Vendor guidance
- Users are recommended to upgrade to version 3.2.0, which fixes the issue.
More Apache Software Foundation advisories
CVE-2026-124495Nov 11, 2026When workers run as the topology owner, the Logviewer serves filesCVE-2026-94125Nov 11, 2026Nimbus returns the worker placement of every topology running on a supervisor, includingCVE-2026-82436Nov 9, 2026Apache Storm: Description `DefaultStateSerializer`, used to persist and restore statefulCVE-2026-82427Sep 14, 2026Apache Storm: Description A topology's `topology.blobstore.map` lets the submitter chooseCVE-2026-82428Sep 14, 2026Apache Storm: Description Dependency artifacts uploaded with `storm jar --artifacts`CVE-2026-82429Sep 14, 2026Apache Storm: Description The setuid-root `worker-launcher` binary adjusts ownership
Apache Software Foundation advisories, November 2026All Apache Software Foundation advisories
Get an email when Apache publishes the next one.
See Apache's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
