CVE-2026-82438: Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

<p>Posted by Richard Zowalla on Sep 13</p>Severity: important <br /> <br /> Affected versions:<br /> <br /> - Apache Storm Webapp (org.apache.storm:storm-webapp) 3.0.0 before 3.1.0<br /> <br /> Description:<br /> <br /> Description<br /> <br /> Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm&apos;s HTTP<br /> components served to an authenticated us