CVE-2026-82438: Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins
Three CORS misconfigurations in Apache Storm 3.0.0 let malicious web pages from arbitrary origins read authenticated API responses.
CVE-2026-82438 (severity: important) affects Apache Storm Webapp (storm-webapp) versions 3.0.0 before 3.1.0. Three separate mechanisms allowed a web page on an unrelated origin to read responses served to authenticated users, including the Logviewer reflecting the request's Origin header in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials. This enables a malicious site to silently exfiltrate authenticated Storm API and log data from a victim's browser session.
- CVE-2026-82438 rated important by Apache
- Affects Apache Storm Webapp 3.0.0 before 3.1.0
- Logviewer reflected arbitrary Origin with credentials allowed
- Enables cross-origin theft of authenticated API responses
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82438 | CORS/JSONP Flaws Expose Apache Storm UI, Logviewer and DRPC Data to Any Website | 8.1 | — |
From the original article
Posted by Richard Zowalla on Sep 13 Severity: important Affected versions: - Apache Storm Webapp (org. apache. storm:storm-webapp) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.