CVE-2026-82438: Apache Storm CORS misconfiguration allows credential-based data exposure

CVE-2026-82438 · Severity: high · CVSS 8.1 · Published 2026-09-14

Apache Storm is an open-source distributed real-time computation system used to process large data streams. Multiple cross-origin request handling flaws in Storm's HTTP components allow an attacker to trick an authenticated operator into visiting a malicious web page, which can then silently read sensitive cluster, topology, and log data from the victim's authenticated session—potentially exposing operational details and logs without the operator's knowledge or consent.

Technologies: Apache Storm. Vendors: Apache.

Quick answers

Is CVE-2026-82438 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-82438 being exploited in the wild.
How severe is CVE-2026-82438?
High severity, with a CVSS score of 8.1, published 14 September 2026.
Which products and versions are affected?
Apache Storm before 3.1.0.
Is there a fix for CVE-2026-82438?
A patch was published on 2026-09-14: Fixed in version 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82438 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-82438?
Check whether you run Apache Storm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability comprises three distinct CORS and same-origin policy bypass mechanisms: (1) the Logviewer reflects the request Origin header into Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials: true, removing the browser protection normally afforded by wildcard CORS policies; (2) a shared CORS filter used across the UI, Logviewer, and DRPC is misconfigured with an initialization parameter name instead of a response header name, causing the container to ignore the setting and apply permissive defaults that allow credentials; and (3) both UI and Logviewer wrap API responses in caller-supplied JSONP callbacks for all GET requests without restriction, allowing any origin to bypass same-origin policy entirely. All three flaws enable a page visited by an authenticated operator to exfiltrate cluster, topology, and log data on their behalf. The fix is available in version 3.1.0 and addresses all three mechanisms; users unable to upgrade should place affected endpoints behind a reverse proxy that strips CORS headers and rejects callback parameters.

Affected products

  • Apache Storm before 3.1.0

Timeline

  • 2026-09-14: disclosed
  • 2026-09-14: patched: Fixed in version 3.1.0

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.