CVE-2026-35337 Details
Description
Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject() without any class filtering or validation. An authenticated user with topology submission rights could supply a crafted serialized object in the "TGT" credential field, leading to remote code execution in both the Nimbus and Worker JVMs. Mitigation: 2.x users should upgrade to 2.8.6. Users who cannot upgrade immediately should monkey-patch an ObjectInputFilter allow-list to ClientAuthUtils.deserializeKerberosTicket() restricting deserialized classes to javax.security.auth.kerberos.KerberosTicket and its known dependencies. A guide on how to do this is available in the release notes of 2.8.6. Credit: This issue was discovered by K.
A deserialization vulnerability has been identified in Apache Storm versions prior to 2.8.6. When topology credentials are processed through the Nimbus Thrift API, Storm decodes the base64-encoded Kerberos Ticket Granting Ticket (TGT) using ObjectInputStream.readObject() without any validation or class filtering. This flaw allows an authenticated user with the right to submit topologies to inject a malicious serialized object into the TGT credential field, potentially executing remote code in both the Nimbus and Worker JVMs.
Users of Apache Storm 2.x should upgrade to version 2.8.6. For those unable to upgrade immediately, it is recommended to apply a monkey-patch that adds an ObjectInputFilter allow-list to the ClientAuthUtils.deserializeKerberosTicket() method, restricting deserialization to javax.security.auth.kerberos.KerberosTicket and its known dependencies. Instructions for this workaround are available in the release notes for version 2.8.6.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/04/12/6 | CVE | Mailing ListThird Party Advisory |
| https://storm.apache.org/2026/04/12/storm286-released.html | [email protected] | Release NotesVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache storm | >= 2.0.0, < 2.8.6 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 15, 2026 | Initial Analysis | [email protected] |
| Apr 13, 2026 | CVE Modified | CISA-ADP |
| Apr 13, 2026 | New CVE Received | [email protected] |
| Apr 13, 2026 | CVE Modified | CVE |