- Exploited
- No known exploitation
- Fix
- Fixed in 3.1.0
- Who is exposed
- Not reported
Do first: Upgrade to a fixed version: 3.1.0.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 10/100 · provisional
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Apache Storm Client is affected by a flaw in how its state serializer restores saved checkpoints from the state store, which can let an attacker who can write to that store run code inside the worker JVM. This requires the non-default Redis-backed state provider and write access to the topology's keys in that store, which is a data-plane privilege rather than general access to the worker.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
Description
DefaultStateSerializer, used to persist and restore stateful bolt checkpoints, configured Kryo with class registration disabled and an instantiation strategy that constructs objects without invoking their constructors, then deserialized whatever bytes the state store returned. A party able to write to the topology's keyspace in the state store, for example a co-tenant of a shared Redis instance or anyone with network access to it, could therefore place a serialized object graph that executes code inside the worker JVM when the state is restored.
This requires the Redis-backed state provider, which is not the default. Write access to a state-store key is a data-plane privilege; code execution in the worker JVM is not, so the two are not equivalent.
Mitigation
Upgrade to 3.1.0, where the state serializer requires registered classes.
Note that this is a behaviour change for existing state: checkpoints written by an affected version may fail to restore, and a migration step may be required. Users who cannot upgrade immediately should restrict network and credential access to the state store to the cluster itself.
Credit
The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure?/25Unknown. No advisory context yet
- Reach10/20Affects Maven packages
- Severity?/10Unknown. No CVSS score or vendor rating
- No patch0/5No signal
What would change the score
- Would score about 65 if added to CISA KEV
- Would score about 60 if CISA's SSVC rates exploitation active
- Would score about 32 if advisories confirm default setups are exposed
Impact
- Widely used
34 packages depend on org.apache.storm:storm-client.Source: deps.dev
What to do
Upgrade to a fixed version: 3.1.0.
Timeline
- CVE published
- First seen by cve.now
- Record last updated
Affected versions
From 3.0.0 · fixed in 3.1.0
Fixed in 3.1.0 (released Sep 11, 2026, 59 days before disclosure).
The latest release, 3.1.0, is not affected.
Evidence 2
- Advisory
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-82436
Is CVE-2026-82436 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
Which versions are affected by CVE-2026-82436?
org.apache.storm:storm-client (Maven): from 3.0.0 before 3.1.0.Source: cve.now feed data
How do I fix CVE-2026-82436?
Upgrade to a fixed version: 3.1.0.Source: cve.now feed data