The vulnerability lies in defaultStateSerializer, which uses Kryo without class registration and constructs objects without invoking constructors during state restoration. An attacker with write access to the topology’s keyspace in the Redis-backed state store can inject a malicious serialized object graph. When the worker JVM restores state, the malicious code is executed, compromising confidentiality, integrity, and availability of the cluster.

Apache Storm Client versions prior to 3.1.0 are impacted, as defined by the Apache Software Foundation. The issue is specific to deployments that configure a Redis-backed state provider, which is not the default configuration.

The exploit requires write access to the Redis state store, a data‑plane privilege that does not grant code execution. The attack vector is likely on the network, where an adversary can reach the state store. EPSS data is unavailable and the vulnerability is not listed in CISA KEV, indicating that a known exploit is not yet documented. Despite the lack of a published CVSS score, the potential for arbitrary code execution in a worker JVM makes the risk high for affected systems.