Executive brief
Apache Storm is a distributed real-time computation system used for processing large streams of data. A security vulnerability in its management interface (Storm UI) allows an authenticated user to inject malicious scripts into the system's metadata. If an administrator or operator views the affected dashboard, these scripts could execute in their browser, potentially allowing the attacker to perform unauthorized actions or gain administrative control.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Apache Storm UI visualization component. The functions parseNode() and parseEdge() in the visualization JavaScript interpolate topology metadata—including component IDs, stream names, and grouping values—directly into the HTML DOM via innerHTML without sanitization. An authenticated attacker with topology submission rights can craft a malicious topology containing JavaScript payloads (e.g., within a bolt ID using an onerror handler). When an administrator views the visualization, the payload is rendered via vis.js tooltips, leading to script execution and potential privilege escalation. The issue is fixed in version 2.8.6.
Affected products
- Apache Storm UI before 2.8.6
Timeline
- 2026-04-12: patched: Version 2.8.6 released with security fixes.
- 2026-04-13: disclosed: Initial advisory publication.