Home / Vulnerability Intelligence / CVE-2026-35337

CVE-2026-35337 - Vulnerability Analysis

HighCVSS: 8.8

Last Updated: April 13, 2026

Apache Storm - Insecure Deserialization

Published: April 13, 2026Updated: April 13, 2026Remote Exploitable

Overview

Apache Storm < 2.8.6 contains an insecure deserialization vulnerability caused by unfiltered deserialization of base64-encoded TGT blobs in Nimbus Thrift API, letting authenticated users with topology submission rights execute remote code.

Severity & Score

Severity: High

CVSS Score: 8.8

Impact

Authenticated users with topology submission rights can execute arbitrary code remotely, compromising Nimbus and Worker JVMs.

Mitigation

Upgrade to version 2.8.6 or later. Apply ObjectInputFilter allow-list patch if immediate upgrade is not possible.

References

Related Resources

Details

CVE ID: CVE-2026-35337
Severity: High
CVSS Score: 8.8
Type: insecure_deserialization
Status: unconfirmed

CWE

CWE-502

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H