Apache Storm deserializes a base64‑encoded Kerberos TGT blob from topology credentials using ObjectInputStream.readObject() without validating or filtering the class types. This flaw allows an attacker with topology submission rights to embed a crafted serialized object in the TGT field of a Nimbus Thrift API call, which can be executed by the Nimbus and Worker JVMs. The result is arbitrary code execution on the Storm cluster nodes.

Any installation of the Apache Storm client before version 2.8.6 is affected. The vulnerability impacts both Nimbus and Worker components, which process the submitted topology credentials.

The flaw carries high severity due to remote code execution, but the exploitation requires authenticated access to submit a topology. EPSS data is unavailable and the vulnerability is not currently listed in the CISA KEV catalogue. As the attack vector relies on authorized topology submission, an internal attacker or a compromised client with those rights could exploit the vulnerability. Implementing the vendor patch at the earliest mitigates the risk entirely.