The vulnerability allows an authenticated user with the right to submit topology definitions to insert malicious HTML or JavaScript into component identifiers. This data is stored and later rendered by the Storm UI visualization layer using innerHTML without any sanitization. As a result, when an operator or administrator views the affected topology, the embedded script executes in the browser session, compromising those higher‑privilege users. The impact is the ability to run arbitrary code in the context of administrators or operators, enabling credential theft, lateral movement, or further attacks on the underlying cluster.

Apache Storm UI from the Apache Software Foundation is affected for all versions prior to 2.8.6. Only the UI component that renders topology metadata is impacted; the core Storm cluster remains unaffected unless an attacker also possesses UI access.

The attack requires authentication to submit a topology and access to the UI, which is typically restricted to trusted users. No publicly available CVSS score or EPSS entry is listed, but the presence of a stored XSS and the potential for privilege escalation indicate a non‑negligible risk to systems where topology submission rights are granted to multiple tenants. The vulnerability is not listed in the CISA KEV catalog. Exposure depends on the current access controls in place; if operators can view any submitted topology, the risk is significantly higher.