CVE-2026-82428: Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

<p>Posted by Richard Zowalla on Sep 13</p>Severity: important <br /> <br /> Affected versions:<br /> <br /> - Apache Storm Client (org.apache.storm:storm-client) 3.0.0 before 3.1.0<br /> <br /> Description:<br /> <br /> Description<br /> <br /> Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from<br /> the Maven coordinate, for example `dep---.j