Executive brief
Apache Storm is a distributed stream processing system used for real-time data analysis. When users upload dependency artifacts using the `storm jar --artifacts` feature in multi-tenant deployments, the artifacts are stored with a predictable key based only on the Maven coordinate. An attacker can upload a malicious artifact first, and any subsequent user requesting the same dependency receives the attacker's code, enabling arbitrary code execution within another tenant's topology.
Technical details
The vulnerability is a privilege escalation and code injection flaw in Apache Storm's blob storage mechanism for dependency artifacts. When `storm jar --artifacts` is invoked, dependency blobs are stored under keys derived solely from Maven coordinates (e.g., `dep---.jar`), making them predictable and identical across all cluster users. If a blob with that key already exists, the uploader silently reuses it without validating the owner or content. An attacker who uploads a blob first can inject malicious code that executes in every subsequent submitter's topology. The attack requires a multi-tenant cluster where multiple principals can create blobs and use the `--artifacts` feature. Mitigation requires upgrading both the Storm cluster to version 3.1.0+ (where artifacts receive unique UUIDs) and all clients running `storm jar --artifacts`.
Affected products
- Apache Storm before 3.1.0
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Fixed in Apache Storm 3.1.0