CVE-2026-82428: Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys
Apache Storm stores shared dependency jars under predictable Maven-derived blob keys, allowing one tenant to substitute jars other tenants execute.
CVE-2026-82428 affects Apache Storm Client (org.apache.storm:storm-client) versions 3.0.0 before 3.1.0, rated important. Dependency artifacts uploaded with storm jar --artifacts were stored under blob keys derived only from the Maven coordinate, making keys identical and predictable for every cluster user. When a blob already existed, the uploader suppressed the collision, enabling a tenant to substitute dependency jars later executed by other tenants in cross-tenant attacks. Fixed in version 3.1.0.
- Affects Apache Storm Client 3.0.0 before 3.1.0
- Blob keys derived solely from Maven coordinates are predictable across tenants
- Existing-blob collisions are swallowed, enabling cross-tenant jar substitution
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82428 | Cross-Tenant Jar Substitution RCE via Predictable Blob Keys in Apache Storm | 8.8 | — |
From the original article
Posted by Richard Zowalla on Sep 13 Severity: important Affected versions: - Apache Storm Client (org. apache. storm:storm-client) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.