EUVD-2026-77529
GHSA-5f32-8637-hcrg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable cluster, low-privilege authenticated attacker, no victim interaction; scope changes because attacker's code runs inside a different tenant's security context.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
5Description PRE-NVD
AnalysisAI
Cross-tenant code execution in Apache Storm Client 3.0.x allows any authenticated cluster user to pre-position a malicious JAR under a predictable blob key and have it loaded into a victim tenant's worker topology. The blob key for --artifacts dependency uploads is derived solely from the Maven coordinate, making it identical and guessable for all cluster principals; when the key already exists the client silently reuses the blob without verifying ownership or content integrity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the targeted Storm cluster must be multi-tenant, meaning more than one principal can authenticate and write blobs; (2) at least one victim topology must be submitted using the `storm jar --artifacts` feature rather than bundling all dependencies in the uber-JAR; and (3) the attacker must be able to upload a blob under the target Maven coordinate before the victim first submits their topology, either by pre-positioning or by winning a race on first submission. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The real-world risk is meaningfully high despite the absence of a formal CVSS score in the source data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Apache Storm Client (org.apache.storm:storm-client) to version 3.1.0 or later, which generates UUID-suffixed blob keys and eliminates silent blob reuse. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Apache Storm 3.0.x deployments and assess whether they operate in multi-tenant or shared-user configurations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today