The vulnerability involves improper handling of TLS client authentication failure in Apache Storm's TlsTransportPlugin. When TLS transport is enabled without requiring client certificates, a missing or failed verification causes the plugin to capture and ignore SSLPeerUnverifiedException, then assigns the fallback principal CN=ANONYMOUS. This fail‑open behavior allows an unauthenticated client to connect over TLS and receive a valid principal identity. If the authorizer, such as SimpleACLAuthorizer, does not deny this principal, the client may gain unauthorized access to Storm services. This flaw is a form of authentication bypass (CWE-287).

The affected product is Apache Storm Client from the Apache Software Foundation. Versions up to and including 2.8.7 are vulnerable. The failure occurs when TLS transport is enabled but client authentication is not enforced.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, so exploitation likelihood cannot be determined, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw by establishing a TLS connection to any Storm cluster whose configuration does not require client certificates or whose authorizer does not explicitly deny the CN=ANONYMOUS principal. Because the exploitation requires no special privileges or advanced payloads, the threat is accessible to any network actor who can reach the Storm service.