# CVE-2026-35337: Apache Storm remote code execution via unsafe deserialization in Nimbus Thrift API

Source: https://junglewise.ai/threats/cve-2026-35337-apache-storm-remote-code-execution-via-unsafe-deserialization-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-13. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-35337 · Severity: high · CVSS 8.8 · Published 2026-04-13

Apache Storm is a distributed real-time computation system used for processing large volumes of data. A security vulnerability in how the system handles authentication credentials allows an authorized user to execute malicious code on the central management server and worker nodes. This could lead to a complete takeover of the data processing cluster, potentially resulting in data theft or service disruption.

Technologies: [Apache Storm](https://junglewise.ai/threats/technologies/storm). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-35337 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35337 being exploited in the wild.

**How severe is CVE-2026-35337?** High severity, with a CVSS score of 8.8, published 13 April 2026.

**Which products and versions are affected?** Apache Storm before 2.8.6; org.apache.storm:storm-client (Maven) < 2.8.6, ECOSYSTEM:introduced=0,fixed=2.8.6.

**Is there a fix for CVE-2026-35337?** Yes. org.apache.storm:storm-client (Maven): upgrade to 2.8.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35337 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-35337?** Check whether you run Apache Storm or org.apache.storm:storm-client (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.storm:storm-client (Maven): upgrade to 2.8.6 or later

  ```sh
  # set org.apache.storm:storm-client to 2.8.6 in your pom.xml or build.gradle
  ```


## Technical details

A deserialization of untrusted data vulnerability exists in Apache Storm's Nimbus Thrift API. When processing topology credentials, the system uses ObjectInputStream.readObject() to deserialize base64-encoded Ticket Granting Ticket (TGT) blobs without implementing class filtering or validation. An authenticated attacker with topology submission privileges can provide a specially crafted serialized object in the 'TGT' credential field. Successful exploitation results in remote code execution (RCE) within the context of both the Nimbus (master) and Worker JVMs. The issue is resolved in version 2.8.6 by implementing proper deserialization filters.

## Affected products

- Apache Storm Client before 2.8.6

## Identifiers

- CVE-2026-35337
- GHSA-jf89-3q6q-vcgr

## Timeline

- 2026-04-12: patched: Version 2.8.6 released
- 2026-04-13: advisory: GitHub and NVD advisories published

## References

- [https://storm.apache.org/2026/04/12/storm286-released.html](https://storm.apache.org/2026/04/12/storm286-released.html)
- [http://www.openwall.com/lists/oss-security/2026/04/12/6](http://www.openwall.com/lists/oss-security/2026/04/12/6)

## Related threats

- [Apache Storm Nimbus information disclosure in worker placement](https://junglewise.ai/threats/cve-2026-94125-nimbus-returns-the-worker-placement-of-every-topology-running-on)
- [Apache Storm Logviewer symlink traversal in worker logs](https://junglewise.ai/threats/cve-2026-124495-when-workers-run-as-the-topology-owner-the-logviewer-serves)
- [Apache Storm arbitrary class instantiation in scheduler](https://junglewise.ai/threats/cve-2026-82440-description-nimbus-instantiates-the-class-named-by-a-topology-s)
- [Apache Storm unsafe deserialization in state serialization](https://junglewise.ai/threats/cve-2026-82436-description-defaultstateserializer-used-to-persist-and-restore)
- [Apache Storm CORS misconfiguration allows credential-based data exposure](https://junglewise.ai/threats/cve-2026-82438-apache-storm-cors-misconfiguration-allows-credential-based-data)