Apache IoTDB authorization issue vulnerability (CNVD-2026-28234)

Apache IoTDB is an open-source IoT database developed by the Apache Foundation in the United States. Versions of Apache IoTDB from 1.3.3 to 2.0.8 contained an authorization vulnerability. This vulnerability stemmed from the lack of strict validation of the sessionId parameter by certain Thrift RP...

User Impersonation

Overview org.apache.iotdb:iotdb-server is a data management system for time series data, which can provide users specific services, such as, data collection, storage and analysis. Affected versions of this package are vulnerable to User Impersonation in certain Thrift RPC query handlers, which do...