CVE-2026-82438: Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP com

A vulnerability in Storm's HTTP components allowed malicious websites to read sensitive data (cluster information, topology details, and logs) from authenticated users through three separate security flaws: the Logviewer reflected user origins in security headers while allowing credentials, a CORS filter (cross-origin resource sharing, which controls what websites can access data from other origins) was misconfigured to allow credentials, and both the UI and Logviewer wrapped API responses in JSONP callbacks (a technique that lets any webpage load data by circumventing normal browser security rules).