High 8.8Published Apr 13, 2026

CVE-2026-35337Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling

Updated under an hour ago (Oct 25, 2026, 11:23 PM ET)

Does this affect you?

It affects Apache Software Foundation Apache Storm Client and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Apache Software Foundation Apache Storm Client

Exploited in the last 30 days

Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject() without any class filtering or validation. An authenticated user with topology submission rights could supply a crafted serialized object in the "TGT" credential field, leading to remote code execution in both the Nimbus and Worker JVMs. Mitigation: 2.x users should upgrade to 2.8.6. Users who cannot upgrade immediately should monkey-patch an ObjectInputFilter allow-list to ClientAuthUtils.deserializeKerberosTicket() restricting deserialized classes to javax.security.auth.kerberos.KerberosTicket and its known dependencies. A guide on how to do this is available in the release notes of 2.8.6. Credit: This issue was discovered by K.

CVSS: 8.8 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-502
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: apache
NVD analysis: Analyzed
Record last updated: Apr 13, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Apache Software Foundation Apache Storm Client apache_software_foundation:apache_storm_client (from the name)	before 2.8.6	CNA record
apache storm apache:storm	from 2.0.0 before 2.8.6	NVD

References

https://storm.apache.org/2026/04/12/storm286-released.htmlvendor-advisory, release-notes
http://www.openwall.com/lists/oss-security/2026/04/12/6mailing-list, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.