Skip to content
OpenAdvisories

Package · Maven

org.apache.storm:storm-client

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.5
    CVE-2026-41081

    Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure

    Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm Versions Affected: up to 2.8.7 Description: When TLS transport is enabled in Apache Storm without requiring client certificate authentication (the…

    Apache Software Foundation Apache Storm Client org.apache.storm:storm-client Maven
  • High 8.8
    CVE-2026-35337

    Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling

    Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.rea…

    Apache Software Foundation Apache Storm Client org.apache.storm:storm-client Maven