An authenticated user with topology‑submission rights can embed malicious script into topology metadata. The Storm UI rendering component injects these values directly into HTML via innerHTML, stashing the payload until an operator or administrator views the topology. When the tooltip renders, the attacker’s JavaScript runs in the admin’s browser, providing a vector for privilege escalation or data theft.

Apache Storm UI from the Apache Software Foundation, versions prior to 2.8.6, are affected.

The CVSS base score is 5.4 and the EPSS is below 1 %, indicating moderate severity but low exploitation probability. The vulnerability is not listed in CISA’s KEV. Exploitation requires the attacker to be able to submit a topology with crafted identifiers and for a privileged user to subsequently view that topology, which makes it a managed‑internal threat. While the vector is not remote, it can lead to serious privilege escalation in multi‑tenant deployments, especially if topology submission is not restricted to trusted users.