# CVE-2026-82428: Apache Storm artifact upload privilege escalation

Source: https://junglewise.ai/threats/cve-2026-82428-apache-storm-artifact-upload-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-82428 · Severity: high · CVSS 8.8 · Published 2026-09-14

Apache Storm is a distributed stream processing system used for real-time data analysis. When users upload dependency artifacts using the `storm jar --artifacts` feature in multi-tenant deployments, the artifacts are stored with a predictable key based only on the Maven coordinate. An attacker can upload a malicious artifact first, and any subsequent user requesting the same dependency receives the attacker's code, enabling arbitrary code execution within another tenant's topology.

Technologies: [Apache Storm](https://junglewise.ai/threats/technologies/storm). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-82428 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82428 being exploited in the wild.

**How severe is CVE-2026-82428?** High severity, with a CVSS score of 8.8, published 14 September 2026.

**Which products and versions are affected?** Apache Storm before 3.1.0.

**Is there a fix for CVE-2026-82428?** A patch was published on 2026-09-14: Fixed in Apache Storm 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82428 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82428?** Check whether you run Apache Storm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a privilege escalation and code injection flaw in Apache Storm's blob storage mechanism for dependency artifacts. When `storm jar --artifacts` is invoked, dependency blobs are stored under keys derived solely from Maven coordinates (e.g., `dep---.jar`), making them predictable and identical across all cluster users. If a blob with that key already exists, the uploader silently reuses it without validating the owner or content. An attacker who uploads a blob first can inject malicious code that executes in every subsequent submitter's topology. The attack requires a multi-tenant cluster where multiple principals can create blobs and use the `--artifacts` feature. Mitigation requires upgrading both the Storm cluster to version 3.1.0+ (where artifacts receive unique UUIDs) and all clients running `storm jar --artifacts`.

## Affected products

- Apache Storm before 3.1.0

## Timeline

- 2026-09-14: disclosed
- 2026-09-14: patched: Fixed in Apache Storm 3.1.0

## Related threats

- [Apache Storm Nimbus information disclosure in worker placement](https://junglewise.ai/threats/cve-2026-94125-nimbus-returns-the-worker-placement-of-every-topology-running-on)
- [Apache Storm Logviewer symlink traversal in worker logs](https://junglewise.ai/threats/cve-2026-124495-when-workers-run-as-the-topology-owner-the-logviewer-serves)
- [Apache Storm arbitrary class instantiation in scheduler](https://junglewise.ai/threats/cve-2026-82440-description-nimbus-instantiates-the-class-named-by-a-topology-s)
- [Apache Storm unsafe deserialization in state serialization](https://junglewise.ai/threats/cve-2026-82436-description-defaultstateserializer-used-to-persist-and-restore)
- [Apache Storm CORS misconfiguration allows credential-based data exposure](https://junglewise.ai/threats/cve-2026-82438-apache-storm-cors-misconfiguration-allows-credential-based-data)