Skip to content
Fencer Intel
low —

CVE-2026-124496 json

Apache Storm: DRPC HTTP doAsUser bypasses the impersonation authorizer

published 22h ago modified 15h ago also EUVD-2026-123414

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue.

Patch / fix

  • maven org.apache.storm:storm-server 3.2.0
  • Apache Software Foundation Apache Storm 3.2.0

Is CVE-2026-124496 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
maven org.apache.storm:storm-server
>=3.0.0, <3.2.0
3.2.0

Affected products

  • Apache Software Foundation Apache Storm

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.