CVE-2026-82428

Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...

CVE-2026-82428 Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...

EUVD-2026-77529

Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...

CVE-2026-82428

Apache Storm versions before 3.1.0 are vulnerable to cross-tenant dependency substitution when the --artifacts feature is used. Dependency artifacts were stored under blob keys derived solely from the Maven coordinate (e.g., dep---.jar), making them predictable and identical for all users. If the...

CVE-2019-11065

Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site...