Code Execution Vulnerability in Apache Storm for Multi-Tenant Environments

CVE-2026-82428

What is CVE-2026-82428?

The vulnerability arises from the way Apache Storm handles dependency artifacts uploaded via the storm jar --artifacts command. Blobs are stored using a predictable key derived from the Maven coordinate, rendering them accessible to all users within the cluster. Consequently, if a blob already exists under the identical key, it is silently reused without verifying the integrity of its content or the ownership, enabling potential code execution by malicious users. In multi-tenant setups, this poses significant risks as a user controlling a blob can affect the worker classpath for all other users. To mitigate this risk, it is crucial to upgrade to version 3.1.0 or later, where a unique UUID is appended to each blob key, preventing key reuse and ensuring enhanced security.

References