You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@storm.apache.org by gi...@apache.org on 2026/09/13 09:42:56 UTC
(storm-site) branch asf-site updated: publishing 2026-09-13T09:42:51+00:00
This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/storm-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new 5919b0803f publishing 2026-09-13T09:42:51+00:00
5919b0803f is described below
commit 5919b0803f1fc18c2915ac12acb846de66c732ce
Author: GitHub Actions Bot <>
AuthorDate: Sun Sep 13 09:42:51 2026 +0000
publishing 2026-09-13T09:42:51+00:00
---
2026/09/12/storm310-released.html | 59 +++++++++++++++++++++---------------
feed.xml | 63 +++++++++++++++++++++++----------------
news.html | 59 +++++++++++++++++++++---------------
3 files changed, 107 insertions(+), 74 deletions(-)
diff --git a/2026/09/12/storm310-released.html b/2026/09/12/storm310-released.html
index 797fe07e04..f7824b7382 100644
--- a/2026/09/12/storm310-released.html
+++ b/2026/09/12/storm310-released.html
@@ -356,18 +356,29 @@ unpatched there and migrate to 3.x, where they are fixed in 3.1.0.</p>
scheduler-strategy allowlist, JSONP wrapping, the state serializer and
<code>nimbus.groups</code> evaluation); please read the mitigations below before upgrading.</p>
-<h2 id="thanks">Thanks</h2>
+<h2 id="thanks">🙏 Thanks</h2>
<p>Special thanks are due to all those who have contributed to Apache Storm --
whether through direct code contributions, documentation, bug reports, security
reports, or helping other users on the mailing lists. Your efforts are much
appreciated.</p>
-<h2 id="changes-in-this-release-storm-3-1-0">Changes in this Release - Storm 3.1.0</h2>
+<h2 id="changes-in-this-release-storm-3-1-0">📋 Changes in this Release - Storm 3.1.0</h2>
<p>JIRA issues and pull requests addressed in the 3.1.0 release of Storm. Documentation for this release is available at the <a href="https://storm.apache.org/">Apache Storm project site</a>.</p>
-<h2>Security Fixes</h2>
+<style>
+.cve-credit {
+ margin: 0.4em 0 1.8em;
+ padding: 0.55em 0.9em;
+ border-left: 4px solid #0066cc;
+ background: #eef4ff;
+ border-radius: 4px;
+}
+.cve-credit strong { color: #0066cc; }
+</style>
+
+<h2>🔒 Security Fixes</h2>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82426">CVE-2026-82426</a> - Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location</h3>
@@ -377,7 +388,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the submitted location is canonicalised and must resolve inside the Nimbus inbox. Users who cannot upgrade immediately should restrict submission via <code>nimbus.users</code>/<code>nimbus.groups</code> and rotate the Nimbus keytab and any TLS private keys or ZooKeeper credentials readable by the Nimbus daemon user. Local mode is unaffected.</p>
-<p><strong>Credit:</strong> Independently reported to the Apache Storm PMC by n0mi1k, with a proof of concept. Also found by the ASF using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> Independently reported to the Apache Storm PMC by n0mi1k, with a proof of concept. Also found by the ASF using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82427">CVE-2026-82427</a> - Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name</h3>
@@ -387,7 +398,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the resolved target must lie inside the expected root at both call sites. Users who cannot upgrade immediately should restrict submission to trusted principals and may reject <code>topology.blobstore.map</code> entries containing path separators or <code>..</code> before they reach Nimbus.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82428">CVE-2026-82428</a> - Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys</h3>
@@ -397,7 +408,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where each uploaded artifact receives a key carrying a freshly generated UUID and a pre-existing blob is no longer silently reused. The corrected key generation is on the submitting client, so every client running <code>storm jar --artifacts</code> must also be upgraded; upgrading the cluster alone does not close it. Operators should audit existing <code>dep-</code> blobs for unexpected owners.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82429">CVE-2026-82429</a> - Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher</h3>
@@ -407,7 +418,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the privileged walk operates on file descriptors it has already stat'd rather than on pathnames re-resolved at call time. The launcher must be rebuilt and reinstalled after upgrading; replacing the Java artifacts alone is not sufficient. Users who cannot upgrade should not run untrusted topology code on supervisors configured with <code>supervisor.run.worker.as.user</code>.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82430">CVE-2026-82430</a> - Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant</h3>
@@ -417,7 +428,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the command file is validated before the ownership change and re-verified on open, and mount sources and destinations are constrained by configuration. The launcher must be rebuilt and reinstalled after upgrading. Users who cannot upgrade should disable Docker/OCI worker isolation or restrict submission on affected supervisors to trusted principals.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82431">CVE-2026-82431</a> - Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users</h3>
@@ -427,7 +438,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where <code>nimbus.groups</code> is evaluated whether or not <code>nimbus.users</code> is set. Users who cannot upgrade should also populate <code>nimbus.users</code>, since a non-empty user list causes the group list to be evaluated on affected versions, and review Nimbus access logs. Note: after upgrading, a cluster configured with <code>nimbus.groups</code> alone becomes restrictive for the first time -- clients outside the configured [...]
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82432">CVE-2026-82432</a> - Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides</h3>
@@ -437,7 +448,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where rebalance overrides are validated exactly as submission-time configuration is, against the rebalancing caller, and <code>listBlobs</code> applies the configured authorization. Users who cannot upgrade should restrict rebalance rights to trusted principals, noting that membership of a topology's <code>topology.users</code>/<code>topology.groups</code> confers them.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82433">CVE-2026-82433</a> - Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI</h3>
@@ -447,7 +458,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where credential-bearing values are masked before the configuration is served and every UI API endpoint must declare its authorization explicitly. Users who cannot upgrade should place the UI behind an authenticating reverse proxy restricting <code>/api/v1/cluster/configuration</code>, and rotate the ZooKeeper authentication payload and any TLS keystore/truststore passwords reachable through it.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82434">CVE-2026-82434</a> - Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs</h3>
@@ -457,7 +468,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the payload is removed from the configuration served to read-only callers and is no longer written to logs. Users who cannot upgrade immediately should rotate <code>storm.zookeeper.topology.auth.payload</code> for existing topologies, review retained logs and support bundles for the value, and restrict read-only topology permissions to trusted principals.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82435">CVE-2026-82435</a> - Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder</h3>
@@ -467,7 +478,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where frames are decoded only after the handshake completes. Users who cannot upgrade should ensure worker slot ports are reachable only from within the cluster and enable <code>storm.messaging.netty.authentication</code> where the deployment permits.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82436">CVE-2026-82436</a> - Apache Storm Client: Deserialization of Untrusted Data from the State Store</h3>
@@ -477,7 +488,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the state serializer requires registered classes. Note this is a behaviour change for existing state: checkpoints written by an affected version may fail to restore and a migration step may be required. Users who cannot upgrade should restrict network and credential access to the state store to the cluster itself.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82437">CVE-2026-82437</a> - Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer</h3>
@@ -487,7 +498,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the daemon log paths evaluate the same configured user/group lists the worker log paths already used, and the listing endpoints filter by the requesting user. Users who cannot upgrade should place the Logviewer behind a reverse proxy that restricts the daemon log endpoints.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82438">CVE-2026-82438</a> - Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins</h3>
@@ -497,7 +508,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the Logviewer no longer reflects the request origin in a credentialed response, the CORS filter is configured explicitly, and JSONP wrapping is governed by <code>ui.enable.jsonp</code> (default false). Disabling JSONP is a behaviour change for tooling that passes a <code>callback</code> parameter. Users who cannot upgrade should front these endpoints with a reverse proxy that strips the CORS headers and rejects <code>callback</code>.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82439">CVE-2026-82439</a> - Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC</h3>
@@ -507,7 +518,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where a function's queue is removed once nothing is waiting in it. Users who cannot upgrade should configure <code>drpc.authorizer</code> so only trusted principals can reach the DRPC endpoints and ensure the DRPC ports are not reachable from untrusted networks.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82440">CVE-2026-82440</a> - Apache Storm Nimbus: Submitter-Controlled Class Instantiation in Nimbus via a Fail-Open Scheduler Strategy Allowlist</h3>
@@ -517,7 +528,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where an unset allowlist means the strategies shipped with Storm rather than any class. This is a behaviour change: a cluster running an out-of-tree strategy without an explicit allowlist will have those topologies refused until the class is added to <code>nimbus.scheduler.strategy.class.whitelist</code>. Users who cannot upgrade should set that key explicitly.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82441">CVE-2026-82441</a> - Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys</h3>
@@ -527,7 +538,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where a submission is refused unless every entry in both lists is a dependency blob key that exists in the blobstore. This validates new submissions only; an operator whose cluster is failing to retain a leader should inspect the Nimbus log for the missing dependency keys and remove or resubmit the topology naming them. Users who cannot upgrade should restrict topology submission to trusted principals.</p>
-<p><strong>Credit:</strong> This issue was discovered by rzo1 while investigating an unrelated blobstore defect.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> This issue was discovered by rzo1 while investigating an unrelated blobstore defect.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-84179">CVE-2026-84179</a> - Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page</h3>
@@ -537,13 +548,13 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where credential-bearing values are masked before any configuration is served over the Nimbus API. Users who cannot upgrade should remove any principal not trusted with cluster credentials from <code>topology.readonly.users</code>, <code>topology.readonly.groups</code>, <code>topology.users</code> and <code>topology.groups</code>, and rotate the ZooKeeper authentication payload and any TLS keystore/truststore passwords reachable through t [...]
-<p><strong>Credit:</strong> Wanxin Yin (yaklang.io) reported this issue to the Apache Security Team.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> Wanxin Yin (yaklang.io) reported this issue to the Apache Security Team.</p>
<h3>Additional acknowledgements</h3>
<p>We also thank n0mi1k for reporting the <code>getTopologyHistory</code> authorization gap addressed in this release by <a href="https://github.com/apache/storm/pull/9003">#9003</a>. It is handled as a hardening improvement and is not covered by a separate advisory.</p>
-<h2>Enhancements</h2>
+<h2>✨ Enhancements</h2>
<ul>
<li>[<a href="https://github.com/apache/storm/pull/8977">#8977</a>] - Add ui.enable.jsonp to control JSONP callback wrapping in UI and Logviewer API responses</li>
@@ -552,7 +563,7 @@ appreciated.</p>
<li>[<a href="https://github.com/apache/storm/issues/7569">#7569</a>] - [STORM-3787] Add error messages in worker-launcher code where it is missing</li>
</ul>
-<h2>Documentation</h2>
+<h2>📖 Documentation</h2>
<ul>
<li>[<a href="https://github.com/apache/storm/pull/8995">#8995</a>] - Document that an unset scheduler strategy whitelist no longer allows every strategy class</li>
@@ -560,7 +571,7 @@ appreciated.</p>
<li>[<a href="https://github.com/apache/storm/pull/8949">#8949</a>] - docs: add missing 3.0.0 feature documentation</li>
</ul>
-<h2>Bug fixing</h2>
+<h2>🐛 Bug fixing</h2>
<ul>
<li>[<a href="https://github.com/apache/storm/pull/9082">#9082</a>] - STORM-3871: sweep dependency blobs that outlive their topology's cleanup</li>
@@ -607,7 +618,7 @@ appreciated.</p>
<li>[<a href="https://github.com/apache/storm/issues/7653">#7653</a>] - [STORM-3871] Storm blobstore leak space</li>
</ul>
-<h2>Dependency upgrades</h2>
+<h2>📦 Dependency upgrades</h2>
<ul>
<li>[<a href="https://github.com/apache/storm/pull/9080">#9080</a>] - build(deps-dev): bump svgo from 4.0.2 to 4.1.0 in /storm-webapp</li>
diff --git a/feed.xml b/feed.xml
index b4b3a1b9a9..98b73d8d54 100644
--- a/feed.xml
+++ b/feed.xml
@@ -5,8 +5,8 @@
<description>Apache Storm is a free and open source distributed realtime computation system. Storm makes it easy to reliably process unbounded streams of data, doing for realtime processing what Hadoop did for batch processing.</description>
<link>https://storm.apache.org/</link>
<atom:link href="https://storm.apache.org/feed.xml" rel="self" type="application/rss+xml"/>
- <pubDate>Sun, 13 Sep 2026 06:26:03 +0000</pubDate>
- <lastBuildDate>Sun, 13 Sep 2026 06:26:03 +0000</lastBuildDate>
+ <pubDate>Sun, 13 Sep 2026 09:42:32 +0000</pubDate>
+ <lastBuildDate>Sun, 13 Sep 2026 09:42:32 +0000</lastBuildDate>
<generator>Jekyll v3.10.0</generator>
<item>
@@ -29,18 +29,29 @@ unpatched there and migrate to 3.x, where they are fixed in 3.1.0.</p>
scheduler-strategy allowlist, JSONP wrapping, the state serializer and
<code>nimbus.groups</code> evaluation); please read the mitigations below before upgrading.</p>
-<h2 id="thanks">Thanks</h2>
+<h2 id="thanks">🙏 Thanks</h2>
<p>Special thanks are due to all those who have contributed to Apache Storm --
whether through direct code contributions, documentation, bug reports, security
reports, or helping other users on the mailing lists. Your efforts are much
appreciated.</p>
-<h2 id="changes-in-this-release-storm-3-1-0">Changes in this Release - Storm 3.1.0</h2>
+<h2 id="changes-in-this-release-storm-3-1-0">📋 Changes in this Release - Storm 3.1.0</h2>
<p>JIRA issues and pull requests addressed in the 3.1.0 release of Storm. Documentation for this release is available at the <a href="https://storm.apache.org/">Apache Storm project site</a>.</p>
-<h2>Security Fixes</h2>
+<style>
+.cve-credit {
+ margin: 0.4em 0 1.8em;
+ padding: 0.55em 0.9em;
+ border-left: 4px solid #0066cc;
+ background: #eef4ff;
+ border-radius: 4px;
+}
+.cve-credit strong { color: #0066cc; }
+</style>
+
+<h2>🔒 Security Fixes</h2>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82426">CVE-2026-82426</a> - Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location</h3>
@@ -50,7 +61,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the submitted location is canonicalised and must resolve inside the Nimbus inbox. Users who cannot upgrade immediately should restrict submission via <code>nimbus.users</code>/<code>nimbus.groups</code> and rotate the Nimbus keytab and any TLS private keys or ZooKeeper credentials readable by the Nimbus daemon user. Local mode is unaffected.</p>
-<p><strong>Credit:</strong> Independently reported to the Apache Storm PMC by n0mi1k, with a proof of concept. Also found by the ASF using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> Independently reported to the Apache Storm PMC by n0mi1k, with a proof of concept. Also found by the ASF using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82427">CVE-2026-82427</a> - Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name</h3>
@@ -60,7 +71,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the resolved target must lie inside the expected root at both call sites. Users who cannot upgrade immediately should restrict submission to trusted principals and may reject <code>topology.blobstore.map</code> entries containing path separators or <code>..</code> before they reach Nimbus.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82428">CVE-2026-82428</a> - Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys</h3>
@@ -70,7 +81,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where each uploaded artifact receives a key carrying a freshly generated UUID and a pre-existing blob is no longer silently reused. The corrected key generation is on the submitting client, so every client running <code>storm jar --artifacts</code> must also be upgraded; upgrading the cluster alone does not close it. Operators should audit existing <code>dep-</code> blobs for unexpected owners.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82429">CVE-2026-82429</a> - Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher</h3>
@@ -80,7 +91,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the privileged walk operates on file descriptors it has already stat'd rather than on pathnames re-resolved at call time. The launcher must be rebuilt and reinstalled after upgrading; replacing the Java artifacts alone is not sufficient. Users who cannot upgrade should not run untrusted topology code on supervisors configured with <code>supervisor.run.worker.as.user</code>.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82430">CVE-2026-82430</a> - Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant</h3>
@@ -90,7 +101,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the command file is validated before the ownership change and re-verified on open, and mount sources and destinations are constrained by configuration. The launcher must be rebuilt and reinstalled after upgrading. Users who cannot upgrade should disable Docker/OCI worker isolation or restrict submission on affected supervisors to trusted principals.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82431">CVE-2026-82431</a> - Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users</h3>
@@ -100,7 +111,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where <code>nimbus.groups</code> is evaluated whether or not <code>nimbus.users</code> is set. Users who cannot upgrade should also populate <code>nimbus.users</code>, since a non-empty user list causes the group list to be evaluated on affected versions, and review Nimbus access logs. Note: after upgrading, a cluster configured with <code>nimbus.groups</code> alone becomes [...]
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82432">CVE-2026-82432</a> - Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides</h3>
@@ -110,7 +121,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where rebalance overrides are validated exactly as submission-time configuration is, against the rebalancing caller, and <code>listBlobs</code> applies the configured authorization. Users who cannot upgrade should restrict rebalance rights to trusted principals, noting that membership of a topology's <code>topology.users</code>/<code>topology.groups</code> confers them.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82433">CVE-2026-82433</a> - Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI</h3>
@@ -120,7 +131,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where credential-bearing values are masked before the configuration is served and every UI API endpoint must declare its authorization explicitly. Users who cannot upgrade should place the UI behind an authenticating reverse proxy restricting <code>/api/v1/cluster/configuration</code>, and rotate the ZooKeeper authentication payload and any TLS keystore/truststore passwords reachable through it.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82434">CVE-2026-82434</a> - Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs</h3>
@@ -130,7 +141,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the payload is removed from the configuration served to read-only callers and is no longer written to logs. Users who cannot upgrade immediately should rotate <code>storm.zookeeper.topology.auth.payload</code> for existing topologies, review retained logs and support bundles for the value, and restrict read-only topology permissions to trusted principals.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82435">CVE-2026-82435</a> - Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder</h3>
@@ -140,7 +151,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where frames are decoded only after the handshake completes. Users who cannot upgrade should ensure worker slot ports are reachable only from within the cluster and enable <code>storm.messaging.netty.authentication</code> where the deployment permits.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82436">CVE-2026-82436</a> - Apache Storm Client: Deserialization of Untrusted Data from the State Store</h3>
@@ -150,7 +161,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the state serializer requires registered classes. Note this is a behaviour change for existing state: checkpoints written by an affected version may fail to restore and a migration step may be required. Users who cannot upgrade should restrict network and credential access to the state store to the cluster itself.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82437">CVE-2026-82437</a> - Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer</h3>
@@ -160,7 +171,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the daemon log paths evaluate the same configured user/group lists the worker log paths already used, and the listing endpoints filter by the requesting user. Users who cannot upgrade should place the Logviewer behind a reverse proxy that restricts the daemon log endpoints.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82438">CVE-2026-82438</a> - Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins</h3>
@@ -170,7 +181,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the Logviewer no longer reflects the request origin in a credentialed response, the CORS filter is configured explicitly, and JSONP wrapping is governed by <code>ui.enable.jsonp</code> (default false). Disabling JSONP is a behaviour change for tooling that passes a <code>callback</code> parameter. Users who cannot upgrade should front these endpoints with a reverse proxy that strips the CORS [...]
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82439">CVE-2026-82439</a> - Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC</h3>
@@ -180,7 +191,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where a function's queue is removed once nothing is waiting in it. Users who cannot upgrade should configure <code>drpc.authorizer</code> so only trusted principals can reach the DRPC endpoints and ensure the DRPC ports are not reachable from untrusted networks.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82440">CVE-2026-82440</a> - Apache Storm Nimbus: Submitter-Controlled Class Instantiation in Nimbus via a Fail-Open Scheduler Strategy Allowlist</h3>
@@ -190,7 +201,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where an unset allowlist means the strategies shipped with Storm rather than any class. This is a behaviour change: a cluster running an out-of-tree strategy without an explicit allowlist will have those topologies refused until the class is added to <code>nimbus.scheduler.strategy.class.whitelist</code>. Users who cannot upgrade should set that key explicitly.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82441">CVE-2026-82441</a> - Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys</h3>
@@ -200,7 +211,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where a submission is refused unless every entry in both lists is a dependency blob key that exists in the blobstore. This validates new submissions only; an operator whose cluster is failing to retain a leader should inspect the Nimbus log for the missing dependency keys and remove or resubmit the topology naming them. Users who cannot upgrade should restrict topology submission to trusted principals.</p>
-<p><strong>Credit:</strong> This issue was discovered by rzo1 while investigating an unrelated blobstore defect.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> This issue was discovered by rzo1 while investigating an unrelated blobstore defect.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-84179">CVE-2026-84179</a> - Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page</h3>
@@ -210,13 +221,13 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where credential-bearing values are masked before any configuration is served over the Nimbus API. Users who cannot upgrade should remove any principal not trusted with cluster credentials from <code>topology.readonly.users</code>, <code>topology.readonly.groups</code>, <code>topology.users</code> and <code>topology.groups</code>, and rotate the ZooKeeper authentication pay [...]
-<p><strong>Credit:</strong> Wanxin Yin (yaklang.io) reported this issue to the Apache Security Team.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> Wanxin Yin (yaklang.io) reported this issue to the Apache Security Team.</p>
<h3>Additional acknowledgements</h3>
<p>We also thank n0mi1k for reporting the <code>getTopologyHistory</code> authorization gap addressed in this release by <a href="https://github.com/apache/storm/pull/9003">#9003</a>. It is handled as a hardening improvement and is not covered by a separate advisory.</p>
-<h2>Enhancements</h2>
+<h2>✨ Enhancements</h2>
<ul>
<li>[<a href="https://github.com/apache/storm/pull/8977">#8977</a>] - Add ui.enable.jsonp to control JSONP callback wrapping in UI and Logviewer API responses</li>
@@ -225,7 +236,7 @@ appreciated.</p>
<li>[<a href="https://github.com/apache/storm/issues/7569">#7569</a>] - [STORM-3787] Add error messages in worker-launcher code where it is missing</li>
</ul>
-<h2>Documentation</h2>
+<h2>📖 Documentation</h2>
<ul>
<li>[<a href="https://github.com/apache/storm/pull/8995">#8995</a>] - Document that an unset scheduler strategy whitelist no longer allows every strategy class</li>
@@ -233,7 +244,7 @@ appreciated.</p>
<li>[<a href="https://github.com/apache/storm/pull/8949">#8949</a>] - docs: add missing 3.0.0 feature documentation</li>
</ul>
-<h2>Bug fixing</h2>
+<h2>🐛 Bug fixing</h2>
<ul>
<li>[<a href="https://github.com/apache/storm/pull/9082">#9082</a>] - STORM-3871: sweep dependency blobs that outlive their topology's cleanup</li>
@@ -280,7 +291,7 @@ appreciated.</p>
<li>[<a href="https://github.com/apache/storm/issues/7653">#7653</a>] - [STORM-3871] Storm blobstore leak space</li>
</ul>
-<h2>Dependency upgrades</h2>
+<h2>📦 Dependency upgrades</h2>
<ul>
<li>[<a href="https://github.com/apache/storm/pull/9080">#9080</a>] - build(deps-dev): bump svgo from 4.0.2 to 4.1.0 in /storm-webapp</li>
diff --git a/news.html b/news.html
index 21f1baeba1..d1fd709f3f 100644
--- a/news.html
+++ b/news.html
@@ -356,18 +356,29 @@ unpatched there and migrate to 3.x, where they are fixed in 3.1.0.</p>
scheduler-strategy allowlist, JSONP wrapping, the state serializer and
<code>nimbus.groups</code> evaluation); please read the mitigations below before upgrading.</p>
-<h2 id="thanks">Thanks</h2>
+<h2 id="thanks">🙏 Thanks</h2>
<p>Special thanks are due to all those who have contributed to Apache Storm --
whether through direct code contributions, documentation, bug reports, security
reports, or helping other users on the mailing lists. Your efforts are much
appreciated.</p>
-<h2 id="changes-in-this-release-storm-3-1-0">Changes in this Release - Storm 3.1.0</h2>
+<h2 id="changes-in-this-release-storm-3-1-0">📋 Changes in this Release - Storm 3.1.0</h2>
<p>JIRA issues and pull requests addressed in the 3.1.0 release of Storm. Documentation for this release is available at the <a href="https://storm.apache.org/">Apache Storm project site</a>.</p>
-<h2>Security Fixes</h2>
+<style>
+.cve-credit {
+ margin: 0.4em 0 1.8em;
+ padding: 0.55em 0.9em;
+ border-left: 4px solid #0066cc;
+ background: #eef4ff;
+ border-radius: 4px;
+}
+.cve-credit strong { color: #0066cc; }
+</style>
+
+<h2>🔒 Security Fixes</h2>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82426">CVE-2026-82426</a> - Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location</h3>
@@ -377,7 +388,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the submitted location is canonicalised and must resolve inside the Nimbus inbox. Users who cannot upgrade immediately should restrict submission via <code>nimbus.users</code>/<code>nimbus.groups</code> and rotate the Nimbus keytab and any TLS private keys or ZooKeeper credentials readable by the Nimbus daemon user. Local mode is unaffected.</p>
-<p><strong>Credit:</strong> Independently reported to the Apache Storm PMC by n0mi1k, with a proof of concept. Also found by the ASF using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> Independently reported to the Apache Storm PMC by n0mi1k, with a proof of concept. Also found by the ASF using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82427">CVE-2026-82427</a> - Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name</h3>
@@ -387,7 +398,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the resolved target must lie inside the expected root at both call sites. Users who cannot upgrade immediately should restrict submission to trusted principals and may reject <code>topology.blobstore.map</code> entries containing path separators or <code>..</code> before they reach Nimbus.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82428">CVE-2026-82428</a> - Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys</h3>
@@ -397,7 +408,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where each uploaded artifact receives a key carrying a freshly generated UUID and a pre-existing blob is no longer silently reused. The corrected key generation is on the submitting client, so every client running <code>storm jar --artifacts</code> must also be upgraded; upgrading the cluster alone does not close it. Operators should audit existing <code>dep-</code> blobs for unexpected owners.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82429">CVE-2026-82429</a> - Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher</h3>
@@ -407,7 +418,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the privileged walk operates on file descriptors it has already stat'd rather than on pathnames re-resolved at call time. The launcher must be rebuilt and reinstalled after upgrading; replacing the Java artifacts alone is not sufficient. Users who cannot upgrade should not run untrusted topology code on supervisors configured with <code>supervisor.run.worker.as.user</code>.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82430">CVE-2026-82430</a> - Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant</h3>
@@ -417,7 +428,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the command file is validated before the ownership change and re-verified on open, and mount sources and destinations are constrained by configuration. The launcher must be rebuilt and reinstalled after upgrading. Users who cannot upgrade should disable Docker/OCI worker isolation or restrict submission on affected supervisors to trusted principals.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82431">CVE-2026-82431</a> - Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users</h3>
@@ -427,7 +438,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where <code>nimbus.groups</code> is evaluated whether or not <code>nimbus.users</code> is set. Users who cannot upgrade should also populate <code>nimbus.users</code>, since a non-empty user list causes the group list to be evaluated on affected versions, and review Nimbus access logs. Note: after upgrading, a cluster configured with <code>nimbus.groups</code> alone becomes restrictive for the first time -- clients outside the configured [...]
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82432">CVE-2026-82432</a> - Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides</h3>
@@ -437,7 +448,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where rebalance overrides are validated exactly as submission-time configuration is, against the rebalancing caller, and <code>listBlobs</code> applies the configured authorization. Users who cannot upgrade should restrict rebalance rights to trusted principals, noting that membership of a topology's <code>topology.users</code>/<code>topology.groups</code> confers them.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82433">CVE-2026-82433</a> - Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI</h3>
@@ -447,7 +458,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where credential-bearing values are masked before the configuration is served and every UI API endpoint must declare its authorization explicitly. Users who cannot upgrade should place the UI behind an authenticating reverse proxy restricting <code>/api/v1/cluster/configuration</code>, and rotate the ZooKeeper authentication payload and any TLS keystore/truststore passwords reachable through it.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82434">CVE-2026-82434</a> - Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs</h3>
@@ -457,7 +468,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the payload is removed from the configuration served to read-only callers and is no longer written to logs. Users who cannot upgrade immediately should rotate <code>storm.zookeeper.topology.auth.payload</code> for existing topologies, review retained logs and support bundles for the value, and restrict read-only topology permissions to trusted principals.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82435">CVE-2026-82435</a> - Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder</h3>
@@ -467,7 +478,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where frames are decoded only after the handshake completes. Users who cannot upgrade should ensure worker slot ports are reachable only from within the cluster and enable <code>storm.messaging.netty.authentication</code> where the deployment permits.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82436">CVE-2026-82436</a> - Apache Storm Client: Deserialization of Untrusted Data from the State Store</h3>
@@ -477,7 +488,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the state serializer requires registered classes. Note this is a behaviour change for existing state: checkpoints written by an affected version may fail to restore and a migration step may be required. Users who cannot upgrade should restrict network and credential access to the state store to the cluster itself.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82437">CVE-2026-82437</a> - Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer</h3>
@@ -487,7 +498,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the daemon log paths evaluate the same configured user/group lists the worker log paths already used, and the listing endpoints filter by the requesting user. Users who cannot upgrade should place the Logviewer behind a reverse proxy that restricts the daemon log endpoints.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82438">CVE-2026-82438</a> - Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins</h3>
@@ -497,7 +508,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where the Logviewer no longer reflects the request origin in a credentialed response, the CORS filter is configured explicitly, and JSONP wrapping is governed by <code>ui.enable.jsonp</code> (default false). Disabling JSONP is a behaviour change for tooling that passes a <code>callback</code> parameter. Users who cannot upgrade should front these endpoints with a reverse proxy that strips the CORS headers and rejects <code>callback</code>.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82439">CVE-2026-82439</a> - Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC</h3>
@@ -507,7 +518,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where a function's queue is removed once nothing is waiting in it. Users who cannot upgrade should configure <code>drpc.authorizer</code> so only trusted principals can reach the DRPC endpoints and ensure the DRPC ports are not reachable from untrusted networks.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82440">CVE-2026-82440</a> - Apache Storm Nimbus: Submitter-Controlled Class Instantiation in Nimbus via a Fail-Open Scheduler Strategy Allowlist</h3>
@@ -517,7 +528,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where an unset allowlist means the strategies shipped with Storm rather than any class. This is a behaviour change: a cluster running an out-of-tree strategy without an explicit allowlist will have those topologies refused until the class is added to <code>nimbus.scheduler.strategy.class.whitelist</code>. Users who cannot upgrade should set that key explicitly.</p>
-<p><strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-82441">CVE-2026-82441</a> - Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys</h3>
@@ -527,7 +538,7 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where a submission is refused unless every entry in both lists is a dependency blob key that exists in the blobstore. This validates new submissions only; an operator whose cluster is failing to retain a leader should inspect the Nimbus log for the missing dependency keys and remove or resubmit the topology naming them. Users who cannot upgrade should restrict topology submission to trusted principals.</p>
-<p><strong>Credit:</strong> This issue was discovered by rzo1 while investigating an unrelated blobstore defect.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> This issue was discovered by rzo1 while investigating an unrelated blobstore defect.</p>
<h3><a href="https://www.cve.org/CVERecord?id=CVE-2026-84179">CVE-2026-84179</a> - Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page</h3>
@@ -537,13 +548,13 @@ appreciated.</p>
<p><strong>Mitigation:</strong> Upgrade to 3.1.0, where credential-bearing values are masked before any configuration is served over the Nimbus API. Users who cannot upgrade should remove any principal not trusted with cluster credentials from <code>topology.readonly.users</code>, <code>topology.readonly.groups</code>, <code>topology.users</code> and <code>topology.groups</code>, and rotate the ZooKeeper authentication payload and any TLS keystore/truststore passwords reachable through t [...]
-<p><strong>Credit:</strong> Wanxin Yin (yaklang.io) reported this issue to the Apache Security Team.</p>
+<p class="cve-credit">🏅 <strong>Credit:</strong> Wanxin Yin (yaklang.io) reported this issue to the Apache Security Team.</p>
<h3>Additional acknowledgements</h3>
<p>We also thank n0mi1k for reporting the <code>getTopologyHistory</code> authorization gap addressed in this release by <a href="https://github.com/apache/storm/pull/9003">#9003</a>. It is handled as a hardening improvement and is not covered by a separate advisory.</p>
-<h2>Enhancements</h2>
+<h2>✨ Enhancements</h2>
<ul>
<li>[<a href="https://github.com/apache/storm/pull/8977">#8977</a>] - Add ui.enable.jsonp to control JSONP callback wrapping in UI and Logviewer API responses</li>
@@ -552,7 +563,7 @@ appreciated.</p>
<li>[<a href="https://github.com/apache/storm/issues/7569">#7569</a>] - [STORM-3787] Add error messages in worker-launcher code where it is missing</li>
</ul>
-<h2>Documentation</h2>
+<h2>📖 Documentation</h2>
<ul>
<li>[<a href="https://github.com/apache/storm/pull/8995">#8995</a>] - Document that an unset scheduler strategy whitelist no longer allows every strategy class</li>
@@ -560,7 +571,7 @@ appreciated.</p>
<li>[<a href="https://github.com/apache/storm/pull/8949">#8949</a>] - docs: add missing 3.0.0 feature documentation</li>
</ul>
-<h2>Bug fixing</h2>
+<h2>🐛 Bug fixing</h2>
<ul>
<li>[<a href="https://github.com/apache/storm/pull/9082">#9082</a>] - STORM-3871: sweep dependency blobs that outlive their topology's cleanup</li>
@@ -607,7 +618,7 @@ appreciated.</p>
<li>[<a href="https://github.com/apache/storm/issues/7653">#7653</a>] - [STORM-3871] Storm blobstore leak space</li>
</ul>
-<h2>Dependency upgrades</h2>
+<h2>📦 Dependency upgrades</h2>
<ul>
<li>[<a href="https://github.com/apache/storm/pull/9080">#9080</a>] - build(deps-dev): bump svgo from 4.0.2 to 4.1.0 in /storm-webapp</li>