Apache Storm Prometheus Reporter contains a configuration option that, when enabled, replaces the JVM’s global SSL context with an insecure context that accepts any certificate. This causes every outbound TLS connection from the Storm daemon—such as ZooKeeper, Thrift, Netty, and the web UI—to trust all certificates, including self‑signed or attacker‑issued ones. The consequence is that an adversary can intercept, alter, or inject traffic across all secured channels, exposing cluster state, topology submission, and administrative credentials.

Apache Software Foundation’s Apache Storm Prometheus Reporter, versions 2.6.3 through 2.8.6. Deployment of Storm clusters using these releases with the skip_tls_validation option set will be affected.

The vulnerability enables a broad man‑in‑the‑middle attack surface. The likely attack vector is the global downgrade of TLS verification that silently relaxes certificate validation for all HTTPS communications. CVSS score 4.8 indicates a moderate severity, while EPSS score < 1% suggests a very low exploitation probability; however, the absence of a secure context still represents a high potential for exploitation. The vulnerability is not listed in CISA KEV, but the impact—including the possibility of intercepting confidential topology and control traffic—demonstrates severe confidentiality and integrity risks.