CVE-2026-82438: Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Apache Storm's web components (UI, Logviewer, and DRPC) contained three distinct cross-origin weaknesses that let a web page on any origin read API responses served to an authenticated operator. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials: true, a shared CORS filter was misconfigured so the container's credential-permitting defaults applied, and the UI and Logviewer wrapped every GET response in a caller-supplied JSONP callback with no way to disable it. An attacker needs only to get an authenticated Storm operator to visit a malicious web page; the page can then silently read cluster, topology, and log data on that operator's behalf. Any deployment running a version prior to 3.1.0 with the UI, Logviewer, or DRPC HTTP endpoints in use is affected. No public proof of concept is known and there is no evidence of exploitation in the wild.

Do: Upgrade to Apache Storm 3.1.0, which stops reflecting the request origin in credentialed responses, configures the CORS filter explicitly, and disables JSONP by default (ui.enable.p=false). If you cannot upgrade immediately, place the UI, Logviewer, and DRPC endpoints behind a reverse proxy that strips Access-Control-Allow-Origin and Access-Control-Allow-Credentials from responses and rejects requests carrying a callback parameter. Check whether any dashboards, scripts, or tooling pass a callback query parameter to the Storm UI or Logviewer and migrate them to ordinary JSON requests before upgrading, since JSONP is now off by default.