Deserialization Vulnerability in Apache Storm by Apache

CVE-2026-35337

What is CVE-2026-35337?

The vulnerability in Apache Storm arises when it processes topology credentials via the Nimbus Thrift API. It deserializes base64-encoded TGT blobs using ObjectInputStream.readObject() without implementing necessary class filtering or validation. This allows an authenticated user with topology submission rights to insert a maliciously crafted serialized object into the 'TGT' credential field, potentially leading to remote code execution in both Nimbus and Worker JVMs. To address this, users are advised to upgrade to version 2.8.6 or apply a monkey-patch allowing only specific classes to be deserialized.

References