Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling

published 2026-04-13 6 mo ago modified 2026-10-26 13 d ago also GHSA-jf89-3q6q-vcgr , EUVD-2026-21902

cvss: 8.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits: 0; none known

Deserialization of Untrusted Data vulnerability in Apache Storm.

Versions Affected: before 2.8.6.

Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject() without any class filtering or validation. An authenticated user with topology submission rights could supply a crafted serialized object in the "TGT" credential field, leading to remote code execution in both the Nimbus and Worker JVMs.

Mitigation: 2.x users should upgrade to 2.8.6.

Users who cannot upgrade immediately should monkey-patch an ObjectInputFilter allow-list to ClientAuthUtils.deserializeKerberosTicket() restricting deserialized classes to javax.security.auth.kerberos.KerberosTicket and its known dependencies. A guide on how to do this is available in the release notes of 2.8.6.

Credit: This issue was discovered by K.

Patch / fix

fixed in 2

maven org.apache.storm:storm-client 2.8.6
Apache Software Foundation Apache Storm Client 2.8.6

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 6 mo ago (2026-04-13)

Exploit prediction

1.01% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.apache.storm:storm-client	<2.8.6	2.8.6

Affected products

Apache Software Foundation Apache Storm Client

Classification

Weakness

CWE-502 Deserialization of Untrusted Data

References

storm.apache.org /2026/04/12/storm286-released.html
vendor-advisory, web, release-notes
openwall.com /lists/oss-security/2026/04/12/6
web, mailing-list, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2026-35337
advisory
github.com /apache/storm
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary