As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-82438: Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins
CVE-2026-82438 affects Apache Storm Webapp versions 3.0.0 before 3.1.0, exposing authenticated application programming interface (API) responses to unrelated web origins through three separate mechanisms including reflected Origin header handling and credentials transmission. The vulnerability allows cross-origin requests to access authenticated user data via the Logviewer and other HTTP components.
Why it matters: Organizations running vulnerable Storm Webapp versions expose authenticated API responses to cross-site request forgery attacks; immediate patching to 3.1.0 or later is required to prevent credential-based data exfiltration.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-82438: Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins
Apache Storm Webapp versions 3.0.0 before 3.1.0 contain a cross-origin resource sharing (CORS) vulnerability that allows web pages from unrelated origins to read authenticated application programming interface (API) responses. Three separate mechanisms in the Logviewer and HTTP components reflect request headers and send credentials without proper origin validation, creating exposure for authenticated users.
Why it matters: Organizations running Storm Webapp 3.0.0 to 3.0.x must upgrade to 3.1.0 immediately, as an attacker can craft a malicious web page to extract sensitive API responses from authenticated sessions.
- Source published
- First seen by Cybersecurity Tracker