A critical vulnerability in Apache Storm Client allows authenticated users to execute arbitrary code within other tenants, posing a significant risk to multi-tenant cluster integrity.

This is an improper resource management flaw where dependency artifacts uploaded via the storm jar command are stored with predictable, user-controlled keys. An authenticated user can exploit this to overwrite or inject malicious code that is subsequently executed by other cluster users.

The ability for a malicious actor to achieve remote code execution within another tenant's topology represents a total compromise of the affected environment. Given the CVSS score of 8.8, this vulnerability carries a high risk of unauthorized data access, lateral movement, and complete loss of tenant isolation. Organizations utilizing multi-tenant Apache Storm clusters are at immediate risk of cross-tenant attacks if they rely on the artifacts dependency feature.

Immediate Action: Upgrade all submitting client installations to version 3.1.0 and ensure the cluster itself is upgraded to the same version.

Proactive Monitoring: Operators should audit existing dep- blobs for unauthorized owners and verify the integrity of uploaded artifacts in the blob store.

Compensating Controls: If an immediate upgrade is not feasible, disable the --artifacts mechanism in multi-tenant environments and distribute dependencies directly within the topology jar to prevent key collisions.

Public Exploit Available: Unknown

The severity of this flaw necessitates immediate attention, particularly in shared or multi-tenant environments. Because the remediation requires updates on both the cluster and the submitting clients, administrators must coordinate a comprehensive deployment strategy to ensure full coverage. Prioritize patching to eliminate the risk of cross-tenant code execution.