Apache Storm CVE-2026-82436

Exploitation requires the Redis-backed state provider (explicitly NOT the default state-store configuration) AND the attacker having write access to the topology's keyspace in that state store - e.g. a co-tenant of a shared Redis instance or anyone with network/credential access to it. It is further gated on the use of stateful bolts whose checkpoints are serialized by DefaultStateSerializer. Limiting factors: default Storm deployments are not affected; the attacker must already hold a data-plane write privilege to the state store; and exploitation only triggers when state is restored. Per the advisory, the only complete fix is upgrading to 3.1.0 (with a possible checkpoint-migration step); operators who cannot upgrade immediately should restrict network and credential access to the state store to the cluster itself.

This is an important-severity deserialization-to-RCE flaw (CWE-502) in Apache Storm Client's DefaultStateSerializer, which configured Kryo with class registration disabled and a constructor-skipping instantiation strategy, then deserialized whatever the state store returned. No CVSS vector was supplied by NVD, no EPSS score is available, and vuln.today's decision label is 'awaiting_data' - so the quantitative signals are effectively absent and cannot be weighed. It is NOT in CISA KEV and no public exploit is identified, so this is not a confirmed widespread-exploitation emergency; it reads as a conditional, high-impact issue rather than a high-CVSS-but-trivial one. The critical mitigating factor is that exploitation requires the Redis-backed state provider (explicitly NOT the default) plus write access to the topology's keyspace in the state store - a data-plane privilege the advisory is careful to distinguish from the code execution it yields. Realistic priority is therefore elevated specifically for multi-tenant/shared-Redis Storm deployments using stateful bolts with the Redis state provider, and low for everyone on default configurations. Key missing data to note explicitly: no NVD CVSS vector, no EPSS, and no KEV/POC signals to corroborate exploitability - priority rests on the vendor advisory alone.

A co-tenant of a shared Redis instance, or anyone with network/credential access to the state store, writes a crafted Kryo-serialized object graph into the topology's keyspace. When a stateful bolt later restores its checkpoint, DefaultStateSerializer deserializes the attacker-supplied bytes without class registration and instantiates objects without calling constructors, executing attacker-controlled code inside the worker JVM. No public PoC or exploit code is identified at time of analysis.