CVE-2026-82428: Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

Apache Storm's `storm jar --artifacts` dependency feature stored uploaded dependency jars in the cluster blobstore under keys derived only from the Maven coordinate (e.g., `dep---.jar`), making the key identical for every cluster user and predictable in advance. When the blob already existed, the client caught KeyAlreadyExistsException and silently reused it, with no verification that the existing blob's content or owner matched the artifact the submitter had resolved. As a result, the first user to upload a given coordinate controls the exact bytes that every later submitter of the same coordinate receives on the worker classpath, producing arbitrary code execution inside another tenant's topology. This affects multi-tenant deployments (where more than one principal may create blobs) that use the --artifacts dependency feature, in versions prior to 3.1.0. No CVSS score has been assigned yet, no public PoC is known, and there is no indication of exploitation in the wild.

Do: Upgrade both the cluster and every machine that runs `storm jar --artifacts` to Apache Storm 3.1.0 — the fixed UUID-based key generation lives in the submitting client, so patching the cluster alone does not close this. Before upgrading, audit existing blobstore keys beginning with `dep-` for unexpected owners or mismatched content and remove or replace them. If you cannot upgrade immediately, stop using the --artifacts mechanism on multi-tenant clusters and distribute dependencies inside the topology jar instead.