Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Storm Client

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2026-82428

    Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

    Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from the Maven coordinate, for example `dep---.jar`. The key was therefore identical for every user of the cluster and predictable in advance. Whe…

    Apache Software Foundation Apache Storm Client
  • High 8.8
    CVE-2026-35337

    Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling

    Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.rea…

    Apache Software Foundation Apache Storm Client org.apache.storm:storm-client Maven