Vulnerability-Lookup

CVE-2026-82438 (GCVE-0-2026-82438)

Vulnerability from cvelistv5 – Published: 2026-09-14 14:02 – Updated: 2026-09-14 19:52

Title

Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Summary

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's `Origin` header back in `Access-Control-Allow-Origin` while also sending `Access-Control-Allow-Credentials: true`. The published security model documents a permissive `Access-Control-Allow-Origin: *` posture as accepted, which is safe precisely because browsers refuse to honour `*` together with credentials; reflecting the concrete origin removes that protection. The shared CORS filter used by the UI, the Logviewer and DRPC was configured with a response header name where an initialisation parameter name was expected. The container ignored the setting and applied its own defaults, which allow credentials. Finally, the UI and Logviewer wrapped API responses in a caller-supplied JSONP callback for every GET request. A script element on any origin can load such a response, which bypasses the same-origin policy entirely rather than negotiating it, and there was no way to turn the behaviour off. In each case the effect is that a page visited by an authenticated operator can read cluster, topology and log data on their behalf. Mitigation Upgrade to 3.1.0, where the Logviewer no longer reflects the request origin in a credentialed response, the CORS filter is configured explicitly, and JSONP wrapping is governed by `ui.enable.jsonp`, which defaults to false. Note that disabling JSONP is a behaviour change for tooling that passes a `callback` query parameter; such tooling should be moved to ordinary JSON requests. Users who cannot upgrade immediately should place the UI, Logviewer and DRPC HTTP endpoints behind a reverse proxy that strips `Access-Control-Allow-Origin` and `Access-Control-Allow-Credentials` from responses and rejects requests carrying a `callback` parameter. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 19:52 UTC

CWE

CWE-346 - Origin Validation Error
CWE-942 - Permissive Cross-domain Security Policy with Untrusted Domains

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/2o7tl3hcdd865njxs…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version	CPE status
Apache Software Foundation	Apache Storm Webapp	Affected: 3.0.0 , < 3.1.0 (semver)	guessed

Credits

The ASF using Claude Agents

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-14T14:13:42.629Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/13/17"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-82438",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T19:52:29.973602Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T19:52:48.724Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.storm:storm-webapp",
          "product": "Apache Storm Webapp",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "The ASF using Claude Agents"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cb\u003eDescription\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eThree separate mechanisms allowed a web page on an unrelated origin to read responses that Storm\u0027s HTTP\u003cbr\u003ecomponents served to an authenticated user.\u003cbr\u003e\u003cbr\u003eThe Logviewer reflected the request\u0027s `Origin` header back in `Access-Control-Allow-Origin` while also\u003cbr\u003esending `Access-Control-Allow-Credentials: true`. The published security model documents a permissive\u003cbr\u003e`Access-Control-Allow-Origin: *` posture as accepted, which is safe precisely because browsers refuse to\u003cbr\u003ehonour `*` together with credentials; reflecting the concrete origin removes that protection.\u003cbr\u003e\u003cbr\u003eThe shared CORS filter used by the UI, the Logviewer and DRPC was configured with a response header name\u003cbr\u003ewhere an initialisation parameter name was expected. The container ignored the setting and applied its own\u003cbr\u003edefaults, which allow credentials.\u003cbr\u003e\u003cbr\u003eFinally, the UI and Logviewer wrapped API responses in a caller-supplied JSONP callback for every GET\u003cbr\u003erequest. A script element on any origin can load such a response, which bypasses the same-origin policy\u003cbr\u003eentirely rather than negotiating it, and there was no way to turn the behaviour off.\u003cbr\u003e\u003cbr\u003eIn each case the effect is that a page visited by an authenticated operator can read cluster, topology and\u003cbr\u003elog data on their behalf.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eMitigation\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eUpgrade to 3.1.0, where the Logviewer no longer reflects the request origin in a credentialed response, the\u003cbr\u003eCORS filter is configured explicitly, and JSONP wrapping is governed by `ui.enable.jsonp`, which defaults to\u003cbr\u003efalse.\u003cbr\u003e\u003cbr\u003eNote that disabling JSONP is a behaviour change for tooling that passes a `callback` query parameter; such\u003cbr\u003etooling should be moved to ordinary JSON requests.\u003cbr\u003e\u003cbr\u003eUsers who cannot upgrade immediately should place the UI, Logviewer and DRPC HTTP endpoints behind a reverse\u003cbr\u003eproxy that strips `Access-Control-Allow-Origin` and `Access-Control-Allow-Credentials` from responses and\u003cbr\u003erejects requests carrying a `callback` parameter.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eCredit\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.\u003cbr\u003e"
            }
          ],
          "value": "Description\n\nThree separate mechanisms allowed a web page on an unrelated origin to read responses that Storm\u0027s HTTP\ncomponents served to an authenticated user.\n\nThe Logviewer reflected the request\u0027s `Origin` header back in `Access-Control-Allow-Origin` while also\nsending `Access-Control-Allow-Credentials: true`. The published security model documents a permissive\n`Access-Control-Allow-Origin: *` posture as accepted, which is safe precisely because browsers refuse to\nhonour `*` together with credentials; reflecting the concrete origin removes that protection.\n\nThe shared CORS filter used by the UI, the Logviewer and DRPC was configured with a response header name\nwhere an initialisation parameter name was expected. The container ignored the setting and applied its own\ndefaults, which allow credentials.\n\nFinally, the UI and Logviewer wrapped API responses in a caller-supplied JSONP callback for every GET\nrequest. A script element on any origin can load such a response, which bypasses the same-origin policy\nentirely rather than negotiating it, and there was no way to turn the behaviour off.\n\nIn each case the effect is that a page visited by an authenticated operator can read cluster, topology and\nlog data on their behalf.\n\nMitigation\n\nUpgrade to 3.1.0, where the Logviewer no longer reflects the request origin in a credentialed response, the\nCORS filter is configured explicitly, and JSONP wrapping is governed by `ui.enable.jsonp`, which defaults to\nfalse.\n\nNote that disabling JSONP is a behaviour change for tooling that passes a `callback` query parameter; such\ntooling should be moved to ordinary JSON requests.\n\nUsers who cannot upgrade immediately should place the UI, Logviewer and DRPC HTTP endpoints behind a reverse\nproxy that strips `Access-Control-Allow-Origin` and `Access-Control-Allow-Credentials` from responses and\nrejects requests carrying a `callback` parameter.\n\nCredit\n\nThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346 Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-942",
              "description": "CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T14:02:07.213Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/2o7tl3hcdd865njxsn4d9cxp1frkctz3"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-82438",
    "datePublished": "2026-09-14T14:02:07.213Z",
    "dateReserved": "2026-08-29T10:37:41.671Z",
    "dateUpdated": "2026-09-14T19:52:48.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-82438\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2026-09-14T15:17:10.900\",\"lastModified\":\"2026-09-14T20:58:48.430\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Description\\n\\nThree separate mechanisms allowed a web page on an unrelated origin to read responses that Storm\u0027s HTTP\\ncomponents served to an authenticated user.\\n\\nThe Logviewer reflected the request\u0027s `Origin` header back in `Access-Control-Allow-Origin` while also\\nsending `Access-Control-Allow-Credentials: true`. The published security model documents a permissive\\n`Access-Control-Allow-Origin: *` posture as accepted, which is safe precisely because browsers refuse to\\nhonour `*` together with credentials; reflecting the concrete origin removes that protection.\\n\\nThe shared CORS filter used by the UI, the Logviewer and DRPC was configured with a response header name\\nwhere an initialisation parameter name was expected. The container ignored the setting and applied its own\\ndefaults, which allow credentials.\\n\\nFinally, the UI and Logviewer wrapped API responses in a caller-supplied JSONP callback for every GET\\nrequest. A script element on any origin can load such a response, which bypasses the same-origin policy\\nentirely rather than negotiating it, and there was no way to turn the behaviour off.\\n\\nIn each case the effect is that a page visited by an authenticated operator can read cluster, topology and\\nlog data on their behalf.\\n\\nMitigation\\n\\nUpgrade to 3.1.0, where the Logviewer no longer reflects the request origin in a credentialed response, the\\nCORS filter is configured explicitly, and JSONP wrapping is governed by `ui.enable.jsonp`, which defaults to\\nfalse.\\n\\nNote that disabling JSONP is a behaviour change for tooling that passes a `callback` query parameter; such\\ntooling should be moved to ordinary JSON requests.\\n\\nUsers who cannot upgrade immediately should place the UI, Logviewer and DRPC HTTP endpoints behind a reverse\\nproxy that strips `Access-Control-Allow-Origin` and `Access-Control-Allow-Credentials` from responses and\\nrejects requests carrying a `callback` parameter.\\n\\nCredit\\n\\nThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.\"}],\"affected\":[{\"source\":\"security@apache.org\",\"affectedData\":[{\"vendor\":\"Apache Software Foundation\",\"product\":\"Apache Storm Webapp\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.maven.apache.org/maven2\",\"packageName\":\"org.apache.storm:storm-webapp\",\"versions\":[{\"version\":\"3.0.0\",\"lessThan\":\"3.1.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-14T19:52:29.973602Z\",\"id\":\"CVE-2026-82438\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-346\"},{\"lang\":\"en\",\"value\":\"CWE-942\"}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/2o7tl3hcdd865njxsn4d9cxp1frkctz3\",\"source\":\"security@apache.org\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/09/13/17\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-09-14T14:02:07.213Z\"}, \"title\": \"Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins\", \"problemTypes\": [{\"descriptions\": [{\"description\": \"CWE-346 Origin Validation Error\", \"lang\": \"en\", \"cweId\": \"CWE-346\", \"type\": \"CWE\"}]}, {\"descriptions\": [{\"description\": \"CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains\", \"lang\": \"en\", \"cweId\": \"CWE-942\", \"type\": \"CWE\"}]}], \"source\": {\"discovery\": \"UNKNOWN\"}, \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Storm Webapp\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"packageName\": \"org.apache.storm:storm-webapp\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.0.0\", \"lessThan\": \"3.1.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"descriptions\": [{\"value\": \"Description\\n\\nThree separate mechanisms allowed a web page on an unrelated origin to read responses that Storm\u0027s HTTP\\ncomponents served to an authenticated user.\\n\\nThe Logviewer reflected the request\u0027s `Origin` header back in `Access-Control-Allow-Origin` while also\\nsending `Access-Control-Allow-Credentials: true`. The published security model documents a permissive\\n`Access-Control-Allow-Origin: *` posture as accepted, which is safe precisely because browsers refuse to\\nhonour `*` together with credentials; reflecting the concrete origin removes that protection.\\n\\nThe shared CORS filter used by the UI, the Logviewer and DRPC was configured with a response header name\\nwhere an initialisation parameter name was expected. The container ignored the setting and applied its own\\ndefaults, which allow credentials.\\n\\nFinally, the UI and Logviewer wrapped API responses in a caller-supplied JSONP callback for every GET\\nrequest. A script element on any origin can load such a response, which bypasses the same-origin policy\\nentirely rather than negotiating it, and there was no way to turn the behaviour off.\\n\\nIn each case the effect is that a page visited by an authenticated operator can read cluster, topology and\\nlog data on their behalf.\\n\\nMitigation\\n\\nUpgrade to 3.1.0, where the Logviewer no longer reflects the request origin in a credentialed response, the\\nCORS filter is configured explicitly, and JSONP wrapping is governed by `ui.enable.jsonp`, which defaults to\\nfalse.\\n\\nNote that disabling JSONP is a behaviour change for tooling that passes a `callback` query parameter; such\\ntooling should be moved to ordinary JSON requests.\\n\\nUsers who cannot upgrade immediately should place the UI, Logviewer and DRPC HTTP endpoints behind a reverse\\nproxy that strips `Access-Control-Allow-Origin` and `Access-Control-Allow-Credentials` from responses and\\nrejects requests carrying a `callback` parameter.\\n\\nCredit\\n\\nThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.\", \"lang\": \"en\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cb\u003eDescription\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eThree separate mechanisms allowed a web page on an unrelated origin to read responses that Storm\u0027s HTTP\u003cbr\u003ecomponents served to an authenticated user.\u003cbr\u003e\u003cbr\u003eThe Logviewer reflected the request\u0027s `Origin` header back in `Access-Control-Allow-Origin` while also\u003cbr\u003esending `Access-Control-Allow-Credentials: true`. The published security model documents a permissive\u003cbr\u003e`Access-Control-Allow-Origin: *` posture as accepted, which is safe precisely because browsers refuse to\u003cbr\u003ehonour `*` together with credentials; reflecting the concrete origin removes that protection.\u003cbr\u003e\u003cbr\u003eThe shared CORS filter used by the UI, the Logviewer and DRPC was configured with a response header name\u003cbr\u003ewhere an initialisation parameter name was expected. The container ignored the setting and applied its own\u003cbr\u003edefaults, which allow credentials.\u003cbr\u003e\u003cbr\u003eFinally, the UI and Logviewer wrapped API responses in a caller-supplied JSONP callback for every GET\u003cbr\u003erequest. A script element on any origin can load such a response, which bypasses the same-origin policy\u003cbr\u003eentirely rather than negotiating it, and there was no way to turn the behaviour off.\u003cbr\u003e\u003cbr\u003eIn each case the effect is that a page visited by an authenticated operator can read cluster, topology and\u003cbr\u003elog data on their behalf.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eMitigation\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eUpgrade to 3.1.0, where the Logviewer no longer reflects the request origin in a credentialed response, the\u003cbr\u003eCORS filter is configured explicitly, and JSONP wrapping is governed by `ui.enable.jsonp`, which defaults to\u003cbr\u003efalse.\u003cbr\u003e\u003cbr\u003eNote that disabling JSONP is a behaviour change for tooling that passes a `callback` query parameter; such\u003cbr\u003etooling should be moved to ordinary JSON requests.\u003cbr\u003e\u003cbr\u003eUsers who cannot upgrade immediately should place the UI, Logviewer and DRPC HTTP endpoints behind a reverse\u003cbr\u003eproxy that strips `Access-Control-Allow-Origin` and `Access-Control-Allow-Credentials` from responses and\u003cbr\u003erejects requests carrying a `callback` parameter.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eCredit\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.\u003cbr\u003e\"}]}], \"references\": [{\"url\": \"https://lists.apache.org/thread/2o7tl3hcdd865njxsn4d9cxp1frkctz3\", \"tags\": [\"vendor-advisory\"]}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"important\"}}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"credits\": [{\"lang\": \"en\", \"value\": \"The ASF using Claude Agents\", \"type\": \"finder\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.3\"}}, \"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/09/13/17\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-09-14T14:13:42.629Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-82438\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-14T19:52:29.973602Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-14T19:52:43.917Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-82438\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"apache\", \"dateReserved\": \"2026-08-29T10:37:41.671Z\", \"datePublished\": \"2026-09-14T14:02:07.213Z\", \"dateUpdated\": \"2026-09-14T19:52:48.724Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-82438

Vulnerability from fkie_nvd - Published: 2026-09-14 15:17 - Updated: 2026-09-14 20:58

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	security@apache.org	https://lists.apache.org/thread/2o7tl3hcdd865njxsn4d9cxp1frkctz3
	af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2026/09/13/17

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.storm:storm-webapp",
          "product": "Apache Storm Webapp",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Description\n\nThree separate mechanisms allowed a web page on an unrelated origin to read responses that Storm\u0027s HTTP\ncomponents served to an authenticated user.\n\nThe Logviewer reflected the request\u0027s `Origin` header back in `Access-Control-Allow-Origin` while also\nsending `Access-Control-Allow-Credentials: true`. The published security model documents a permissive\n`Access-Control-Allow-Origin: *` posture as accepted, which is safe precisely because browsers refuse to\nhonour `*` together with credentials; reflecting the concrete origin removes that protection.\n\nThe shared CORS filter used by the UI, the Logviewer and DRPC was configured with a response header name\nwhere an initialisation parameter name was expected. The container ignored the setting and applied its own\ndefaults, which allow credentials.\n\nFinally, the UI and Logviewer wrapped API responses in a caller-supplied JSONP callback for every GET\nrequest. A script element on any origin can load such a response, which bypasses the same-origin policy\nentirely rather than negotiating it, and there was no way to turn the behaviour off.\n\nIn each case the effect is that a page visited by an authenticated operator can read cluster, topology and\nlog data on their behalf.\n\nMitigation\n\nUpgrade to 3.1.0, where the Logviewer no longer reflects the request origin in a credentialed response, the\nCORS filter is configured explicitly, and JSONP wrapping is governed by `ui.enable.jsonp`, which defaults to\nfalse.\n\nNote that disabling JSONP is a behaviour change for tooling that passes a `callback` query parameter; such\ntooling should be moved to ordinary JSON requests.\n\nUsers who cannot upgrade immediately should place the UI, Logviewer and DRPC HTTP endpoints behind a reverse\nproxy that strips `Access-Control-Allow-Origin` and `Access-Control-Allow-Credentials` from responses and\nrejects requests carrying a `callback` parameter.\n\nCredit\n\nThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm."
    }
  ],
  "id": "CVE-2026-82438",
  "lastModified": "2026-09-14T20:58:48.430",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-82438",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-14T19:52:29.973602Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-14T15:17:10.900",
  "references": [
    {
      "source": "security@apache.org",
      "url": "https://lists.apache.org/thread/2o7tl3hcdd865njxsn4d9cxp1frkctz3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2026/09/13/17"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        },
        {
          "lang": "en",
          "value": "CWE-942"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    }
  ]
}

GHSA-XF44-6RJP-V8CM

Vulnerability from github – Published: 2026-09-14 15:32 – Updated: 2026-09-14 21:31

Details

Description

Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user.

The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials: true. The published security model documents a permissive Access-Control-Allow-Origin: * posture as accepted, which is safe precisely because browsers refuse to honour * together with credentials; reflecting the concrete origin removes that protection.

The shared CORS filter used by the UI, the Logviewer and DRPC was configured with a response header name where an initialisation parameter name was expected. The container ignored the setting and applied its own defaults, which allow credentials.

Finally, the UI and Logviewer wrapped API responses in a caller-supplied JSONP callback for every GET request. A script element on any origin can load such a response, which bypasses the same-origin policy entirely rather than negotiating it, and there was no way to turn the behaviour off.

In each case the effect is that a page visited by an authenticated operator can read cluster, topology and log data on their behalf.

Mitigation

Upgrade to 3.1.0, where the Logviewer no longer reflects the request origin in a credentialed response, the CORS filter is configured explicitly, and JSONP wrapping is governed by ui.enable.jsonp, which defaults to false.

Note that disabling JSONP is a behaviour change for tooling that passes a callback query parameter; such tooling should be moved to ordinary JSON requests.

Users who cannot upgrade immediately should place the UI, Logviewer and DRPC HTTP endpoints behind a reverse proxy that strips Access-Control-Allow-Origin and Access-Control-Allow-Credentials from responses and rejects requests carrying a callback parameter.

Credit

The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-82438"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-346"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-14T15:17:10Z",
    "severity": "HIGH"
  },
  "details": "Description\n\nThree separate mechanisms allowed a web page on an unrelated origin to read responses that Storm\u0027s HTTP\ncomponents served to an authenticated user.\n\nThe Logviewer reflected the request\u0027s `Origin` header back in `Access-Control-Allow-Origin` while also\nsending `Access-Control-Allow-Credentials: true`. The published security model documents a permissive\n`Access-Control-Allow-Origin: *` posture as accepted, which is safe precisely because browsers refuse to\nhonour `*` together with credentials; reflecting the concrete origin removes that protection.\n\nThe shared CORS filter used by the UI, the Logviewer and DRPC was configured with a response header name\nwhere an initialisation parameter name was expected. The container ignored the setting and applied its own\ndefaults, which allow credentials.\n\nFinally, the UI and Logviewer wrapped API responses in a caller-supplied JSONP callback for every GET\nrequest. A script element on any origin can load such a response, which bypasses the same-origin policy\nentirely rather than negotiating it, and there was no way to turn the behaviour off.\n\nIn each case the effect is that a page visited by an authenticated operator can read cluster, topology and\nlog data on their behalf.\n\nMitigation\n\nUpgrade to 3.1.0, where the Logviewer no longer reflects the request origin in a credentialed response, the\nCORS filter is configured explicitly, and JSONP wrapping is governed by `ui.enable.jsonp`, which defaults to\nfalse.\n\nNote that disabling JSONP is a behaviour change for tooling that passes a `callback` query parameter; such\ntooling should be moved to ordinary JSON requests.\n\nUsers who cannot upgrade immediately should place the UI, Logviewer and DRPC HTTP endpoints behind a reverse\nproxy that strips `Access-Control-Allow-Origin` and `Access-Control-Allow-Credentials` from responses and\nrejects requests carrying a `callback` parameter.\n\nCredit\n\nThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.",
  "id": "GHSA-xf44-6rjp-v8cm",
  "modified": "2026-09-14T21:31:41Z",
  "published": "2026-09-14T15:32:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82438"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/2o7tl3hcdd865njxsn4d9cxp1frkctz3"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/09/13/17"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-82438 (GCVE-0-2026-82438)

FKIE_CVE-2026-82438

GHSA-XF44-6RJP-V8CM

Tags

Sightings

Nomenclature