CVE-2026-82428: Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from t
Summary
A vulnerability in Apache Storm allows attackers to hijack shared dependencies in multi-tenant clusters. When multiple users upload the same dependency using `storm jar --artifacts`, the system stores it with a predictable name based only on the Maven coordinate (a package identifier), allowing the first uploader to control what code other users receive, leading to code execution in other users' applications.
Solution / Mitigation
Upgrade to Storm 3.1.0, where each uploaded artifact receives a unique key with a freshly generated UUID (universally unique identifier). However, both the cluster AND every client running `storm jar --artifacts` must be upgraded for the fix to work. As an immediate workaround, operators should audit existing `dep-` blobs for unexpected owners, and users unable to upgrade should avoid the `--artifacts` mechanism in multi-tenant clusters and distribute dependencies inside the topology jar (the application package) instead.
Vulnerability Details
EPSS: 0.0%
September 14, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-82428
First tracked: September 14, 2026 at 02:11 PM
Classified by LLM (prompt v3) · confidence: 95%