CVE-2026-35337: 
Java vulnerability analysis and mitigation

CVE-2026-35337 is a Deserialization of Untrusted Data vulnerability (CWE-502) in Apache Storm's storm-client component, enabling authenticated remote code execution via the Nimbus Thrift API. It affects all Apache Storm versions before 2.8.6 (specifically the Maven artifact org.apache.storm:storm-client). The vulnerability was disclosed on April 12–13, 2026, with the fix released in Storm 2.8.6. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, oss-security).

The root cause is the use of ObjectInputStream.readObject() in ClientAuthUtils.deserializeKerberosTicket() to deserialize a base64-encoded Ticket Granting Ticket (TGT) blob submitted as part of topology credentials via the Nimbus Thrift API, with no class filtering or ObjectInputFilter applied (CWE-502). An attacker with topology submission rights can replace the legitimate KerberosTicket object with a crafted gadget-chain payload in the "TGT" credential field. Upon deserialization by the Nimbus server (and subsequently Worker JVMs), the gadget chain executes arbitrary OS commands in the context of the JVM process. No public proof-of-concept exploit code has been identified at this time (GitHub Advisory, oss-security).

Successful exploitation grants an authenticated attacker arbitrary code execution on both the Nimbus master node and Worker JVMs across the Storm cluster, resulting in full confidentiality, integrity, and availability compromise. An attacker could exfiltrate sensitive data processed by Storm topologies, modify cluster configurations, pivot laterally to other systems reachable from the Nimbus or Worker nodes, or disrupt distributed stream processing operations entirely (GitHub Advisory, oss-security).

No public proof-of-concept exploit or evidence of in-the-wild exploitation has been observed as of the time of disclosure. The EPSS score is approximately 0.197% (42nd percentile), indicating a relatively low near-term exploitation probability. Exploitation requires authentication with topology submission privileges, which limits the attack surface compared to unauthenticated vulnerabilities. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, oss-security).

1. Reconnaissance: Identify Apache Storm deployments running versions before 2.8.6, particularly those with the Nimbus Thrift API exposed on the network (default port 6627). Confirm topology submission access is available with a valid account.
2. Obtain topology submission credentials: Authenticate to the Storm cluster using a legitimate account that has topology submission rights.
3. Craft malicious serialized payload: Using a Java deserialization gadget-chain tool (e.g., ysoserial), generate a serialized Java object payload targeting a gadget chain available in the Storm classpath (e.g., Commons Collections, Spring, etc.) that executes a desired command upon deserialization.
4. Base64-encode the payload: Encode the raw serialized bytes as a Base64 string to match the expected format of the "TGT" credential field.
5. Submit crafted topology credentials: Use the Storm Thrift API client to submit a topology with the malicious Base64-encoded payload placed in the "TGT" field of the topology credentials map.
6. Trigger deserialization: The Nimbus server calls ClientAuthUtils.deserializeKerberosTicket(), which invokes ObjectInputStream.readObject() on the attacker-controlled payload without class filtering, executing the embedded gadget chain.
7. Achieve RCE: The gadget chain executes the attacker's command in the Nimbus JVM context; Worker JVMs may also deserialize the credential, extending code execution across the cluster (GitHub Advisory, oss-security).

• Network: Unexpected or anomalous connections to the Nimbus Thrift API port (default 6627) from unusual source IPs or at unusual times; outbound connections from Nimbus or Worker JVM processes to external IPs.
• Logs: Java deserialization exceptions or ClassNotFoundException errors in Nimbus logs during topology submission; unexpected ObjectInputStream stack traces in Storm logs referencing ClientAuthUtils.deserializeKerberosTicket().
• Process: Unusual child processes spawned by the Nimbus or Worker JVM (e.g., bash, sh, curl, wget, python, nc) that are not part of normal Storm operation.
• File System: Unexpected files written to the Storm working directory or /tmp by the Storm process user; new cron jobs, scripts, or binaries created by the Storm service account.
• Topology Submissions: Topology submission events from accounts not typically used for deployment, especially with malformed or unusually large TGT credential fields in audit logs.

The primary remediation is to upgrade Apache Storm to version 2.8.6 or later, which addresses the unsafe deserialization in ClientAuthUtils.deserializeKerberosTicket() (GitHub Advisory, Apache Storm Release). For environments that cannot upgrade immediately, apply a monkey-patch to add an ObjectInputFilter allow-list to ClientAuthUtils.deserializeKerberosTicket(), restricting deserialized classes to javax.security.auth.kerberos.KerberosTicket and its known dependencies — implementation guidance is provided in the Storm 2.8.6 release notes. Additionally, restrict topology submission rights to the minimum set of trusted users to reduce the attack surface (oss-security).

The vulnerability was announced by Richard Zowalla to the oss-security mailing list on April 12, 2026, and received coverage from security news outlets including The Hacker Wire and Infinit Security (oss-security). Social media discussion was noted on Bluesky and Mastodon shortly after disclosure. Community reaction was moderate, with the authenticated-only requirement noted as a mitigating factor limiting broader concern.