Unsafe Pre-Authentication Deserialization In Workers
Priority HIGH 78CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.
Summary
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4
Why it matters now
EPSS 0.6418 99th percentileScored 2026-11-07
Fix Fixed Apache Storm (Apache Software Foundation): v1.2.4org.apache.storm:storm (Maven): 2.2.1, 1.2.4, 2.1.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Storm | v1.0.0 and later; Apache Storm to before v1.2.4 | v1.2.4 | Patch available | CNA |
| — | org.apache.storm:storm (Maven) | 2.2.0 to before 2.2.1 | 2.2.1 | Patch available | GHSA-w729-7633-2fw5 |
| — | org.apache.storm:storm (Maven) | 1.0.0 to before 1.2.4 | 1.2.4 | Patch available | GHSA-w729-7633-2fw5 |
| — | org.apache.storm:storm (Maven) | 2.1.0 to before 2.1.1 | 2.1.1 | Patch available | GHSA-w729-7633-2fw5 |
- Apache Storm VendorApache Affected v1.0.0 and later; Apache Storm to before v1.2.4 Fixed in v1.2.4 Patch available CNA
- org.apache.storm:storm (Maven) Vendor— Affected 2.2.0 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-w729-7633-2fw5
- org.apache.storm:storm (Maven) Vendor— Affected 1.0.0 to before 1.2.4 Fixed in 1.2.4 Patch available GHSA-w729-7633-2fw5
- org.apache.storm:storm (Maven) Vendor— Affected 2.1.0 to before 2.1.1 Fixed in 2.1.1 Patch available GHSA-w729-7633-2fw5
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:storm:*:*:*:*:*:*:*:* | 1.0.0 to before 1.2.4; 2.1.0 to before 2.1.1; 2.2.0 to before 2.2.1 | Vulnerable | Apache |
- cpe:2.3:a:apache:storm:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.2.4; 2.1.0 to before 2.1.1; 2.2.0 to before 2.2.1 Vulnerable ·Apache
Remediation
- Fix · CNA Apache Storm (Apache Software Foundation) Fixed in v1.2.4
- Fix · GHSA-w729-7633-2fw5 org.apache.storm:storm (Maven) Fixed in 2.2.1 Advisory →
- Fix · GHSA-w729-7633-2fw5 org.apache.storm:storm (Maven) Fixed in 1.2.4 Advisory →
- Fix · GHSA-w729-7633-2fw5 org.apache.storm:storm (Maven) Fixed in 2.1.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-40865
- 2026-10-03 Alias added: GHSA-w729-7633-2fw5
References
More Apache Storm vulnerabilities
- TI-2021-15907 Shell Command Injection Vulnerability in Nimbus Thrift Server CVSS 3.1CRITICAL 9.8
- TI-2015-02819 The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to… CVSS 3.0CRITICAL 9.8
- TI-2018-08436 Deserialization of untrusted data in Apache Storm CVSS 3.0CRITICAL 9.8
- TI-2017-07179 It was found that under some situations and configurations of Apache Storm 1.x before… CVSS 3.0HIGH 8.8
- TI-2018-01232 In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and… CVSS 3.0HIGH 8.8
- TI-2026-27475 Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling CVSS 3.1HIGH 8.8
Sources
- CVE-2021-40865 · CVE Program
- CVE-2021-40865 · NVD
- FIRST EPSS
- GHSA-w729-7633-2fw5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences