CVE-2026-82428 Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...

CVE-2026-82428

Apache Storm 's storm jar --artifacts feature stored dependency jars under blob keys derived solely from the Maven coordinate (e.g., dep---.jar), making them predictable and identical across all tenants . When a key already existed, the uploader silently reused the existing blob without verifying...