CVE-2026-82428: Apache Storm artifact upload privilege escalation

CVE-2026-82428 · Severity: high · CVSS 8.8 · Published 2026-09-14

Apache Storm is a distributed stream processing system used for real-time data analysis. When users upload dependency artifacts using the `storm jar --artifacts` feature in multi-tenant deployments, the artifacts are stored with a predictable key based only on the Maven coordinate. An attacker can upload a malicious artifact first, and any subsequent user requesting the same dependency receives the attacker's code, enabling arbitrary code execution within another tenant's topology.

Technologies: Apache Storm. Vendors: Apache.

Quick answers

Is CVE-2026-82428 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-82428 being exploited in the wild.
How severe is CVE-2026-82428?
High severity, with a CVSS score of 8.8, published 14 September 2026.
Which products and versions are affected?
Apache Storm before 3.1.0.
Is there a fix for CVE-2026-82428?
A patch was published on 2026-09-14: Fixed in Apache Storm 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82428 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-82428?
Check whether you run Apache Storm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a privilege escalation and code injection flaw in Apache Storm's blob storage mechanism for dependency artifacts. When `storm jar --artifacts` is invoked, dependency blobs are stored under keys derived solely from Maven coordinates (e.g., `dep---.jar`), making them predictable and identical across all cluster users. If a blob with that key already exists, the uploader silently reuses it without validating the owner or content. An attacker who uploads a blob first can inject malicious code that executes in every subsequent submitter's topology. The attack requires a multi-tenant cluster where multiple principals can create blobs and use the `--artifacts` feature. Mitigation requires upgrading both the Storm cluster to version 3.1.0+ (where artifacts receive unique UUIDs) and all clients running `storm jar --artifacts`.

Affected products

  • Apache Storm before 3.1.0

Timeline

  • 2026-09-14: disclosed
  • 2026-09-14: patched: Fixed in Apache Storm 3.1.0

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.