Aller au contenu
en Se connecter
Non notée

CVE-2026-35337 Deserialization of Untrusted Data vulnerability in Apache Storm

Description

Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject() without any class filtering or validation. An authenticated user with topology submission rights could supply a crafted serialized object in the "TGT" credential field, leading to remote code execution in both the Nimbus and Worker JVMs. Mitigation: 2.x users should upgrade to 2.8.6. Users who cannot upgrade immediately should monkey-patch an ObjectInputFilter allow-list to ClientAuthUtils.deserializeKerberosTicket() restricting deserialized classes to javax.security.auth.kerberos.KerberosTicket and its known dependencies. A guide on how to do this is available in the release notes of 2.8.6. Credit: This issue was discovered by K.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Storm Client 2.8 premières → < 2.8.6 2.8.6

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache Storm Client

Les 5 CVE de Apache Storm Client →
CVE-2026-82428 Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from… Non notée CVE-2026-82431 Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty,… Non notée CVE-2026-82434 Description When ZooKeeper authentication is configured, Storm deliberately retains… 10.0 Critique CVE-2026-41081 Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm… Non notée
Suivre cette CVE