Apache Software Foundation Apache Storm Client vulnerabilities

CVE-2026-35337 [HIGH] CWE-502 CVE-2026-35337: Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject() without any class filtering or validation. An authenticated user with topology submi

CVE-2026-82431 [CRITICAL] CWE-863 CVE-2026-82431: Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nim Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty, before `nimbus.groups` was considered. An operator who restricted cluster access by group alone, leaving `nimbus.users` unset, therefore received no restriction at all: every authenticated principal was permitted every user-leve

CVE-2026-82428 [HIGH] CWE-22 CVE-2026-82428: Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from the Maven coordinate, for example `dep---.jar`. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader caught `KeyAlreadyExistsException` and silently reused

CVE-2026-82434 [MEDIUM] CWE-522 CVE-2026-82434: Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeepe Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, so a user whose only grant was the ability to view a topology received

CVE-2026-41081 [MEDIUM] CWE-287 CVE-2026-41081: Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm Versions Affected: up to 2.8.7 Description: When TLS transport is enabled in Apache Storm without requiring client certificate authentication (the default configuration), the TlsTransportPlugin assigns a fallback principal (CN=ANONYMOUS)