CVE-2026-35337 Apache Software Foundation CVE debrief

Who should care

Apache Storm users, especially those with topology submission rights, should assess exposure and prioritize upgrading or applying mitigations. Operators, platform administrators, and security teams need to review their current deployments, verify exposure, and plan for updates or mitigations. This vulnerability's impact is heightened because an authenticated user can exploit it, emphasizing the need for swift action to secure affected systems.

Why it matters

CVE-2026-35337 is a high-severity vulnerability in Apache Storm that allows remote code execution. Users with topology submission rights can exploit this vulnerability, impacting versions before 2.8.6. Immediate attention is required to upgrade or apply mitigations.

• Remote code execution in Nimbus and Worker JVMs
• Potential for lateral movement within Storm deployments
• Need for immediate upgrade or patching to prevent exploitation
• Verification of current version and exposure required

Technical summary

The vulnerability exists in Apache Storm's handling of topology credentials via the Nimbus Thrift API. An authenticated user can submit a crafted serialized object, leading to remote code execution in both Nimbus and Worker JVMs. This affects versions before 2.8.6. Users with topology submission rights can exploit this vulnerability, and immediate attention is required to upgrade or apply mitigations. The deserialization process lacks class filtering or validation, allowing potential attackers to execute arbitrary code.

Defensive priority

High priority for Apache Storm users, especially those with topology submission rights, to upgrade or apply mitigations.

Recommended defensive actions

• Upgrade Apache Storm to version 2.8.6 or later
• Apply an ObjectInputFilter allow-list patch for temporary mitigation
• Restrict deserialized classes to javax.security.auth.kerberos.KerberosTicket and its dependencies
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and mitigation steps. Apache Storm release notes offer guidance on patching. Users should verify their current version, assess exposure, and prioritize upgrading or applying mitigations. The vulnerability allows remote code execution in Nimbus and Worker JVMs via the Nimbus Thrift API. An authenticated user with topology submission rights can supply a crafted serialized object, impacting versions before 2.8.6.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.