PT-2026-32328 · Apache · Apache Storm

K.Metrics · Published 2026-04-13 · Updated 2026-04-13 · CVE-2026-35337

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Storm versions prior to 2.8.6

Description An issue exists when processing topology credentials submitted via the 'Nimbus Thrift API'. The software deserializes the base64-encoded TGT blob using the readObject() function of ObjectInputStream without class filtering or validation. An authenticated user with topology submission rights can provide a crafted serialized object in the TGT credential field, which may lead to remote code execution in both the Nimbus and Worker JVMs.

Recommendations Upgrade to version 2.8.6. As a temporary workaround, monkey-patch an ObjectInputFilter allow-list to deserializeKerberosTicket() in ClientAuthUtils to restrict deserialized classes to javax.security.auth.kerberos.KerberosTicket and its known dependencies.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-35337

GHSA-JF89-3Q6Q-VCGR

Affected Products

Apache Storm

References · 7

• https://osv.dev/vulnerability/GHSA-jf89-3q6q-vcgr · Vendor Advisory
• https://storm.apache.org/2026/04/12/storm286-released.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35337 · Security Note
• https://github.com/apache/storm · Note
• http://openwall.com/lists/oss-security/2026/04/12/6 · Note
• https://twitter.com/oss_security/status/2043698349115646086 · Twitter Post
• https://twitter.com/CVEnew/status/2043733057228943789 · Twitter Post