Skip to content

CVE record · 1 source

CVE-2026-124496

The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer.

Vendor: Apache Software Foundation
Product: Apache Storm
Weakness: CWE-863

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

20

CVE NVD 2h ago

The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer.

The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are…

Fix available CVE-2026-124496 Apache Software Foundation