Apache Iotdb (Apache Software Foundation) - vulnerabilities (CVEs)
28 CVEs, 3 in the last 30 days, 3 known versions, newest CVE from 2026-10-21. Vendor: Apache Software Foundation.
CVEs of Apache Iotdb
- CVE-2026-59229, 2026-10-21: The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing data loading and deletion operations.…
- CVE-2026-59562, 2026-10-21: Missing authentication for critical function vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are recommended…
- CVE-2026-58663, 2026-10-21: An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are…
- CVE-2026-44630 - CVSS 7.5 (high), 2026-08-10: Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a…
- CVE-2026-40452 - CVSS 7.5 (high), 2026-07-10: Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to…
- CVE-2026-40009 - CVSS 6.5 (medium), 2026-07-10: Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming…
- CVE-2026-40008 - CVSS 9.8 (critical), 2026-07-10: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified…
- CVE-2026-40007 - CVSS 7.5 (high), 2026-07-10: Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap receiver's…
- CVE-2026-40006 - CVSS 7.5 (high), 2026-07-10: Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability…
- CVE-2026-40005 - CVSS 9.1 (critical), 2026-07-10: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. An attacker can write arbitrary files anywhere…
- CVE-2026-28564 - CVSS 9.8 (critical), 2026-07-10: Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached…
- CVE-2026-24013 - CVSS 9.1 (critical), 2026-07-06: Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An…
- CVE-2026-24012 - CVSS 7.5 (high), 2026-07-06: Uncontrolled Resource Consumption vulnerability in Apache IoTDB. Some interface fails to impose reasonable limits on the time span and aggregation interval…
- CVE-2026-24014 - CVSS 9.8 (critical), 2026-07-06: Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient…
- CVE-2025-64152 - CVSS 9.1 (critical), 2026-06-26: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0…
- CVE-2025-55017 - CVSS 9.1 (critical), 2026-06-26: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0…
- CVE-2026-24713 - CVSS 9.8 (critical), 2026-03-09: Improper Input Validation vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7. Users are…
- CVE-2026-24015 - CVSS 9.8 (critical), 2026-03-09: A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7. Users are recommended to upgrade to…
- CVE-2025-48459 - CVSS 5.3 (medium), 2025-09-24: Deserialization of Untrusted Data vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 2.0.5. Users are recommended to upgrade to…
- CVE-2025-48392 - CVSS 7.5 (high), 2025-09-24: A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4. Users are recommended to upgrade to…
- CVE-2025-26864 - CVSS 7.5 (high), 2025-05-14: Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache…
- CVE-2024-24780 - CVSS 9.8 (critical), 2025-05-14: Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function…
- CVE-2023-46226 - CVSS 9.8 (critical), 2024-01-15: Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2. Users are recommended to upgrade to version…
- CVE-2023-51656 - CVSS 9.8 (critical), 2023-12-21: Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4. Users are recommended to upgrade…
- CVE-2023-24831 - CVSS 9.8 (critical), 2023-04-17: Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through…
- CVE-2022-43766 - CVSS 7.5 (high), 2022-10-26: Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with…
- CVE-2022-38370 - CVSS 7.5 (high), 2022-09-05: Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should…
- CVE-2022-38369 - CVSS 8.8 (high), 2022-09-05: Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.
