CVE-2026-82438: Apache Storm CSRF Vulnerability

CVE-2026-82438 Overview

CVE-2026-82438 is a cross-origin information disclosure vulnerability affecting Apache Storm's HTTP components. Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm served to an authenticated operator. The flaw impacts the Logviewer, the shared Cross-Origin Resource Sharing (CORS) filter used by the UI and Distributed Remote Procedure Call (DRPC), and JSONP callback wrapping in the UI and Logviewer. An attacker who lures an authenticated Storm operator to a malicious page can read cluster, topology, and log data on their behalf. The issue is tracked under [CWE-346] Origin Validation Error.

Critical Impact
Attacker-controlled web pages can read authenticated Apache Storm cluster, topology, and log data by exploiting broken CORS handling and unconditional JSONP wrapping.

Affected Products

Apache Storm HTTP components (UI)
Apache Storm Logviewer
Apache Storm DRPC HTTP endpoint

Discovery Timeline

2026-09-14 - CVE-2026-82438 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-82438

Vulnerability Analysis

Apache Storm's HTTP surface exposes three overlapping cross-origin defects. The Logviewer reflects the request's Origin header back in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials: true. Storm's published security model assumes a permissive Access-Control-Allow-Origin: * posture, which browsers refuse to honour together with credentials. Reflecting the concrete origin removes that safety net and permits credentialed cross-origin reads.

The shared CORS filter used by the UI, the Logviewer, and DRPC was configured with a response header name where an initialisation parameter name was expected. The servlet container ignored the setting and applied its own defaults, which allow credentials.

Finally, the UI and Logviewer wrapped API responses in a caller-supplied JSONP callback for every GET request. A <script> element on any origin can load such a response, bypassing the same-origin policy entirely rather than negotiating it, and no configuration switch disabled the behaviour.

Root Cause

The root cause is improper origin validation in Storm's HTTP layer. Origin reflection combined with credentialed responses, a misconfigured CORS filter parameter, and unconditional JSONP wrapping each break the browser's same-origin guarantees.

Attack Vector

An attacker hosts a malicious page and waits for an authenticated Storm operator to visit it. The page issues cross-origin requests or loads a <script> tag pointing at Storm's UI, Logviewer, or DRPC endpoint with a callback query parameter. Storm returns the authenticated response in a form the attacker's page can read, disclosing cluster, topology, and log data.

No verified proof-of-concept code is published for CVE-2026-82438.
See the Apache security discussion and Openwall advisory for technical detail.

Detection Methods for CVE-2026-82438

Indicators of Compromise

HTTP responses from the Logviewer that echo an arbitrary Origin request header value inside Access-Control-Allow-Origin alongside Access-Control-Allow-Credentials: true.
GET requests to Storm UI or Logviewer endpoints carrying a callback query parameter from unexpected user agents or referrers.
Referer headers on Storm HTTP requests that point to domains unrelated to your operations tooling.

Detection Strategies

Inspect Storm UI, Logviewer, and DRPC access logs for callback= query parameters and correlate against known internal tooling.
Audit Storm HTTP response headers for reflected origins combined with Access-Control-Allow-Credentials: true.
Alert on authenticated Storm sessions where the Origin or Referer header does not match the approved operator portal.

Monitoring Recommendations

Forward reverse proxy and Storm HTTP logs to a centralised analytics platform and retain them for cross-origin request review.
Baseline legitimate JSONP callers, if any exist, and flag every other callback parameter usage.
Monitor for unusual outbound requests from operator workstations that correlate with subsequent Storm data access.

How to Mitigate CVE-2026-82438

Immediate Actions Required

Upgrade Apache Storm to version 3.1.0, where the Logviewer no longer reflects the request origin in credentialed responses and JSONP is disabled by default.
Set ui.enable.jsonp to false explicitly and migrate any tooling that relies on callback parameters to standard JSON requests.
Restrict access to the UI, Logviewer, and DRPC endpoints to trusted operator networks only.

Patch Information

Upgrade to Apache Storm 3.1.0. This release fixes origin reflection in the Logviewer, configures the shared CORS filter explicitly, and adds the ui.enable.jsonp toggle, which defaults to false. Consult the Apache Security Discussion and the Openwall OSS Security Update for release detail.

Workarounds

Place the UI, Logviewer, and DRPC HTTP endpoints behind a reverse proxy that strips Access-Control-Allow-Origin and Access-Control-Allow-Credentials from responses.
Configure the reverse proxy to reject any request that carries a callback query parameter.
Require authenticated operator access through a VPN or bastion to reduce exposure to attacker-controlled browser sessions.

bash

# Example NGINX snippet to strip CORS headers and reject callback parameters
location / {
    if ($arg_callback) { return 400; }
    proxy_pass http://storm_backend;
    proxy_hide_header Access-Control-Allow-Origin;
    proxy_hide_header Access-Control-Allow-Credentials;
}