Apache: Claude security scans are the credited finder on five CVEs

01What happened

The Apache Software Foundation posted 20 security advisories to the oss-security list on November 9, 2026: two for Apache Storm from Richard Zowalla and 18 for Apache Airflow from Rahul Vats. Five of the 20 name AI tooling as the finder. The Storm pair credits "The ASF using Claude Agents", and three Airflow advisories credit "Claude Security Scans" as a tool. The other 15 Airflow advisories credit named human researchers.

02How it works

Four of the five AI-found flaws involve untrusted class instantiation or deserialization. In Storm, DefaultStateSerializer configured Kryo with class registration disabled and an instantiation strategy that skips constructors, so bytes from the state store could rebuild an object graph that runs code in the worker JVM. Storm's Nimbus instantiated any no-argument class on its classpath when the scheduler strategy allowlist was unset. Airflow's scheduler deserialized task-controlled XCom values during dependency evaluation and rebuilt DeadlineAlert fields through generic deserialization.

03Who is affected

Apache Storm 3.0.0 before 3.1.0 carries both Storm flaws, though the state store flaw reaches only clusters using the Redis-backed state provider, which the advisory says is not the default. All three AI-found Airflow flaws affect versions before 3.4.0. The Airflow deadline-alert flaw is an incomplete fix of CVE-2026-45360, so deployments that applied that earlier patch stay exposed through the callback and interval fields.

04What to do

Upgrade Apache Airflow to 3.4.0 and Apache Storm to 3.1.0. On Storm, set nimbus.scheduler.strategy.class.whitelist explicitly if you cannot upgrade yet, and plan a checkpoint migration, because 3.1.0 may fail to restore checkpoints written by 3.0.x. On Airflow, review which accounts can author DAGs.

Questions people ask

Which Apache CVEs did Claude-based scanning find?

Five of the 20 advisories the Apache Software Foundation published on November 9, 2026 credit AI scanning. Apache Storm CVE-2026-82436 and CVE-2026-82440 name "The ASF using Claude Agents" as finder. Apache Airflow CVE-2026-82337, CVE-2026-86829 and CVE-2026-113508 name "Claude Security Scans" as a tool, with Apache committers credited for writing the fixes.

Do I need to upgrade Airflow because of these AI-found CVEs?

Apache Airflow deployments on versions before 3.4.0 should upgrade. Airflow 3.4.0, released November 6, 2026, carries the fixes for all three AI-found CVEs plus 15 more credited to human researchers. The most serious of the three, CVE-2026-86829, is rated Important and lets task-controlled XCom values reach deserialization inside the scheduler.

Does the Apache Storm state store flaw affect a default install?

No. Apache Storm CVE-2026-82436 reaches only clusters that use the Redis-backed state provider, which the advisory states is not the default. Exploiting it also needs write access to the topology's keyspace in the state store. Storm 3.1.0 fixes the flaw by requiring registered classes, but checkpoints written by affected versions may fail to restore afterward.

Sources 5 links, all fetched

1. 1openwall.comStorm State Store CVE
2. 2openwall.comStorm Nimbus CVE
3. 3openwall.comAirflow XCom CVE
4. 4openwall.comAirflow Deadline CVE
5. 5airflow.apache.orgAirflow Release Notes