CVE-2026-35337
Deserialization Vulnerability in Apache Storm Enables Remote Code Execution
Publication date: 2026-04-13
Last updated on: 2026-04-15
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | storm | From 2.0.0 (inc) to 2.8.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-35337 is a deserialization of untrusted data vulnerability in Apache Storm versions before 2.8.6.
When processing topology credentials submitted via the Nimbus Thrift API, Apache Storm deserializes a base64-encoded Ticket Granting Ticket (TGT) blob using Java's ObjectInputStream.readObject() method without any class filtering or validation.
This means an authenticated user with topology submission rights can supply a crafted serialized object in the "TGT" credential field, which can lead to remote code execution in both the Nimbus and Worker JVM processes.
How can this vulnerability impact me? :
This vulnerability allows an authenticated user with topology submission privileges to execute arbitrary code remotely on the systems running Apache Storm's Nimbus and Worker JVMs.
Such remote code execution can lead to full compromise of the affected systems, potentially allowing attackers to manipulate data, disrupt services, or gain further access within the environment.
What immediate steps should I take to mitigate this vulnerability?
The primary immediate step to mitigate this vulnerability is to upgrade Apache Storm to version 2.8.6, which contains the fix for this issue.
If upgrading immediately is not possible, users should apply a monkey patch by adding an ObjectInputFilter allow-list to the ClientAuthUtils.deserializeKerberosTicket() method. This patch restricts deserialization to only javax.security.auth.kerberos.KerberosTicket and its known dependencies, preventing unsafe deserialization of untrusted data.
Detailed instructions for applying this monkey patch are available in the release notes of version 2.8.6.