Read the docs
TI-2026-27475 Aliases CVE-2026-35337GHSA-jf89-3q6q-vcgr

Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling

Priority MEDIUM 42CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject() without any class filtering or validation. An authenticated user with topology submission rights could supply a crafted serialized object in the "TGT" credential field, leading to remote code execution in both the Nimbus and Worker JVMs. Mitigation: 2.x users should upgrade to 2.8.6. Users who cannot upgrade immediately should monkey-patch an ObjectInputFilter allow-list to ClientAuthUtils.deserializeKerberosTicket() restricting deserialized classes to javax.security.auth.kerberos.KerberosTicket and its known dependencies. A guide on how to do this is available in the release notes of 2.8.6. Credit: This issue was discovered by K.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01011 63rd percentileScored 2026-11-07
Fix Fixed Apache Storm Client (Apache Software Foundation): 2.8.6org.apache.storm:storm-client (Maven): 2.8.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Storm Clientbefore 2.8.62.8.6Patch availableCNA
—org.apache.storm:storm-client (Maven)before 2.8.62.8.6Patch availableGHSA-jf89-3q6q-vcgr
  • Apache Storm Client VendorApache Affected before 2.8.6 Fixed in 2.8.6 Patch available CNA
  • org.apache.storm:storm-client (Maven) Vendor— Affected before 2.8.6 Fixed in 2.8.6 Patch available GHSA-jf89-3q6q-vcgr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:storm:*:*:*:*:*:*:*:*2.0.0 to before 2.8.6VulnerableApache
  • cpe:2.3:a:apache:storm:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.8.6 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Storm Client (Apache Software Foundation) Fixed in 2.8.6
  • Fix · GHSA-jf89-3q6q-vcgr org.apache.storm:storm-client (Maven) Fixed in 2.8.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-35337
  2. 2026-10-03 Alias added: GHSA-jf89-3q6q-vcgr

References

Advisory 3

Other 1

  • TI-2021-15907 Shell Command Injection Vulnerability in Nimbus Thrift Server CVSS 3.1CRITICAL 9.8
  • TI-2021-17787 Unsafe Pre-Authentication Deserialization In Workers CVSS 3.1CRITICAL 9.8
  • TI-2015-02819 The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to… CVSS 3.0CRITICAL 9.8
  • TI-2018-08436 Deserialization of untrusted data in Apache Storm CVSS 3.0CRITICAL 9.8
  • TI-2017-07179 It was found that under some situations and configurations of Apache Storm 1.x before… CVSS 3.0HIGH 8.8
  • TI-2018-01232 In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and… CVSS 3.0HIGH 8.8
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences