org.apache.storm/storm-client vulnerabilities

Latest org.apache.storm/storm-client CVEs

Newest publication first

1. CVE-2026-82436 Apache Storm Client: Deserialization of Untrusted Data from the State Store

   Published 2026-11-09

   High·CVSS 8.8 EPSS 0.27%

   Description DefaultStateSerializer, used to persist and restore stateful bolt checkpoints, configured Kryo with class registration disabled and an instantiation strategy that constructs objects without invoking their constructors, then deserialized whatever bytes the state store...

2. CVE-2026-82440 Apache Storm Nimbus: Submitter-Controlled Class Instantiation in Nimbus via a Fail-Open Scheduler Strategy Allowlist

   Published 2026-11-09

   High·CVSS 8.1 EPSS 0.25%

   Description Nimbus instantiates the class named by a topology's topology.scheduler.strategy when scheduling it. The allowlist intended to constrain that choice, nimbus.scheduler.strategy.class.whitelist, was treated as "allow any class" when unset, and it had no entry in the ship...

3. CVE-2026-82428 Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

   Published 2026-09-14

   High·CVSS 8.8 EPSS 0.69%

   Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existe...

4. CVE-2026-82431 Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users

   Published 2026-09-14

   Critical·CVSS 9.8 EPSS 0.39%

   Description SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving nimbus.users unset, therefore received no restriction at all...

5. CVE-2026-82434 Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs

   Published 2026-09-14

   Critical·CVSS 10.0 EPSS 0.50%

   Description When ZooKeeper authentication is configured, Storm deliberately retains storm.zookeeper.topology.auth.payload in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, s...

6. CVE-2026-82435 Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder

   Published 2026-09-14

   Critical·CVSS 9.8 EPSS 0.65%

   Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames before any authentication has taken place. It allocated buffers sized from a length field carried in the frame, so a single frame from an unaut...

7. CVE-2026-41081 Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure

   Published 2026-04-27

   Medium·CVSS 6.5 EPSS 0.29%

   Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm Versions Affected: up to 2.8.7 Description: When TLS transport is enabled in Apache Storm without requiring client certificate authentication (the default configuratio...

8. CVE-2026-35337 Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling

   Published 2026-04-13

   High·CVSS 8.8 EPSS 1.0%

   Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject() without any...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.