Apache Storm versions prior to 2.8.6 deserialize base64-encoded TGT blobs from topology credentials using ObjectInputStream.readObject() without any class filtering or validation. This unsafe deserialization allows an authenticated user with topology submission rights to provide a malicious serialized object in the "TGT" credential field, resulting in remote code execution within Nimbus and Worker JVM processes. The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The vendor recommends upgrading to version 2.8.6, which addresses this issue. Alternatively, users can monkey-patch an ObjectInputFilter allow-list to restrict deserialization to javax.security.auth.kerberos.KerberosTicket and its known dependencies as an interim mitigation.

An authenticated user with topology submission privileges can exploit this vulnerability to execute arbitrary code remotely on both Nimbus and Worker JVMs. This could lead to full compromise of the affected Apache Storm nodes running these JVMs. No known exploits in the wild have been reported at this time.

Upgrade Apache Storm to version 2.8.6, which contains an official fix for this vulnerability. For users unable to upgrade immediately, apply a monkey-patch that adds an ObjectInputFilter allow-list to ClientAuthUtils.deserializeKerberosTicket(), restricting deserialized classes to javax.security.auth.kerberos.KerberosTicket and its dependencies. Follow the guidance provided in the 2.8.6 release notes for implementation details.