CVE-2026-82428
HighCVSS 8.8Summary
This vulnerability in Apache Storm affects the `storm jar --artifacts` feature, where dependency artifacts are stored under a blob key derived solely from the Maven coordinate, making it predictable and shared across all users. If the blob already exists, it is silently reused without owner verification, allowing an attacker to control the data that other submitters receive, leading to code execution in another tenant's topology.
Risk Assessment
The risk is potential remote code execution within another tenant's topology on a shared Storm cluster, which could lead to data compromise or privilege escalation.
Recommendation
Upgrade both the client and the cluster to version 3.1.0 or later, where each artifact gets a unique UUID in the key and pre-existing blobs are not reused. Before upgrading, audit existing `dep-` blobs for unexpected owners; if immediate upgrade is not possible, avoid using `--artifacts` in multi-tenant clusters and distribute dependencies inside the topology jar instead.
Other vulnerabilities in Apache Storm
See all- CVE-2026-82433Medium
In Apache Storm before 3.1.0, the getNimbusConf function returns full configuration without redaction, and the UI endpoint /api/v1/cluster/configuration lacks proper authorization, potentially exposing passwords and keys.
- CVE-2026-82432High
In Apache Storm before 3.1.0, the rebalance operation does not revalidate the blobstore map for permissions, and listBlobs lacks authorization checks, allowing an authorized user to access disallowed blobs and disclose metadata.
- CVE-2026-82427High
A vulnerability in Apache Storm allows an attacker to use relative path segments (../) in the `topology.blobstore.map` to force deletion and symlink creation at arbitrary locations, acting as the supervisor user. This can lead to recursive deletion of data and replacement of symlinks, which when workers are launched enables execution of attacker-chosen code as another tenant's OS user, breaking isolation.
- CVE-2026-82426Medium
A vulnerability in Apache Storm allows an authenticated user with topology submission rights to specify any server-side path as the topology jar, bypassing the intended file upload flow. Nimbus opens the path without verifying it was uploaded, enabling access to files readable by the Nimbus daemon user.
- CVE-2026-84179Medium
Vulnerability in Apache Storm allows unauthorized users to read credential data (e.g., storm.zookeeper.auth.payload, keystore/truststore passwords) via the topology API, because Nimbus daemon configuration is merged with topology configuration and returned without redaction.
- CVE-2014-0115High
Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to log.
- CVE-2026-82435Critical
In Apache Storm before 3.1.0, a vulnerability exists: the Netty decoder is installed before authentication and processes frames without verification, allowing an unauthenticated attacker to allocate large buffers and potentially cause memory pressure on workers.
- CVE-2026-82439Critical
The DRPC server in Apache Storm keeps a map from function names to request queues, and entries are never removed. An attacker can send arbitrary function names without authentication (as `drpc.authorizer` is disabled by default), leading to unbounded memory growth and eventual heap exhaustion.
- CVE-2015-3188Critical
The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors.
Original NVD description (English source)
Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from the Maven coordinate, for example `dep---.jar`. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader caught `KeyAlreadyExistsException` and silently reused it, with no check that the existing blob's content or owner matched the artifact the submitter had resolved. A user who uploaded a blob under such a key first therefore controlled the bytes that every later submitter of the same coordinate would receive on the worker classpath, resulting in code execution inside another tenant's topology. This affects deployments where more than one principal may create blobs and where the `--artifacts` dependency feature is used. Mitigation Upgrade to 3.1.0, where each uploaded artifact receives a key carrying a freshly generated UUID and a pre-existing blob is no longer silently reused. Note that the corrected key generation is on the SUBMITTING CLIENT, so upgrading the cluster alone does not close this; every client that runs `storm jar --artifacts` must also be upgraded. Operators should audit existing `dep-` blobs for unexpected owners before upgrading. Users who cannot upgrade immediately should avoid the `--artifacts` mechanism in multi-tenant clusters and distribute dependencies inside the topology jar instead. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.