The vulnerability lies in Apache Storm Client’s handling of topology credentials via the Nimbus Thrift API. Storm deserializes a base64‑encoded Kerberos TGT blob using ObjectInputStream.readObject() without applying any class filtering or validation. An authenticated user who has permission to submit topologies can supply a crafted serialized object in the 'TGT' credential field. This flaw effectively allows the attacker to execute arbitrary code within both the Nimbus and Worker JVMs, giving full control over the Storm cluster. The issue is a classic unsafe deserialization vulnerability (CWE‑502).

Apache Software Foundation’s Apache Storm Client, versions prior to 2.8.6, are affected. Users deploying older Storm releases should verify their installation against the affected version list and ensure they are not running vulnerable code.

The CVSS base score of 8.8 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation is unlikely in the near term and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the attack requires an authenticated user with topology submission rights, which could be an internal threat actor or compromised account. Once such privileges are available, a single malicious credential submission can immediately lead to remote code execution on both Nimbus and Worker processes.