CVE-2026-40454: Out-of-bounds Read

Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bounds reads in IoTDB C++ client TsBlock deserializer crash client process on malformed server data. This issue affects Apache IoTDB C++ client: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10. Users...

CVE-2026-40007: Uncontrolled Recursion

Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipeairgapreceiverenabled=true, the IoTDB AirGap receiver's readLength method calls itself recursively each time it recognises the E-language prefix in socket data, with no depth limit. An unauthenticate...

CVE-2026-40006: Memory Allocation with Excessive Size Value

Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability in Apache IoTDB. When pipeairgapreceiverenabled=true, the IoTDB AirGap pipe receiver accepts raw TCP connections on port 9780 with no...

CVE-2026-40005: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process has write permissions with unsafe API. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to...

CVE-2026-28564: Insufficient Session Expiration

Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credentials This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue...

PT-2026-57103

Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credentials This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue...

CVE-2026-40008: Use of Externally-Controlled Input to Select Classes or Code

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName.newInstance without any validation or allowlisting. This issue affects Apache IoTDB:...

PT-2026-57105

Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability in Apache IoTDB. When pipe air gap receiver enabled=true, the IoTDB AirGap pipe receiver accepts raw TCP connections on port 9780 with no...

PT-2026-57107

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName.newInstance without any validation or allowlisting. This issue affects Apache IoTDB:...

CVE-2026-40452: Incorrect Authorization

Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users. This issue affects Apache IoTDB: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10. Users are recommended to...

CVE-2026-40009: Improper Privilege Management

Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming themselves to internalauditor. This issue affects Apache IoTDB: from 2.0.8 before 2.0.10. Users are recommended to upgrade to version 2.0.10,...

PT-2026-57106

Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe air gap receiver enabled=true, the IoTDB AirGap receiver's readLength method calls itself recursively each time it recognises the E-language prefix in socket data, with no depth limit. An...

User Impersonation

Overview org.apache.iotdb:iotdb-server is a data management system for time series data, which can provide users specific services, such as, data collection, storage and analysis. Affected versions of this package are vulnerable to User Impersonation in certain Thrift RPC query handlers, which do...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation in certain Thrift RPC query handlers, which do not strictly validate the sessionId parameter. An attacker can read time-series data without authenticating by sending query requests carrying a forged sessionId, which t...

org.apache.iotdb:customize-mqtt-example (>=1.3.3, <=2.0.1-beta), org.apache.iotdb:integration-test (>=1.3.3, <=2.0.1-beta) +6 more potentially affected by CVE-2026-24013 via org.apache.iotdb:iotdb-server (>=1.3.3, <=2.0.1-beta)

org.apache.iotdb:iotdb-server MAVEN version =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =2.0.1-beta - org.apache.iotdb:udf-example 1.3.3 Source cves: CVE-2026-24013 Source advisory: SNYK:JAVA-ORGAPACHEIOTDB-17874247...

org.apache.iotdb:customize-mqtt-example (>=1.3.3, <=2.0.1-beta), org.apache.iotdb:integration-test (>=1.3.3, <=2.0.1-beta) +6 more potentially affected by CVE-2026-24014 via org.apache.iotdb:iotdb-server (>=1.3.3, <=2.0.1-beta)

org.apache.iotdb:iotdb-server MAVEN version =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =2.0.1-beta - org.apache.iotdb:udf-example 1.3.3 Source cves: CVE-2026-24014 Source advisory: SNYK:JAVA-ORGAPACHEIOTDB-17822329...

org.apache.iotdb:client-example (>=1.3.3, <=2.0.7), org.apache.iotdb:customize-mqtt-example (>=1.3.3, <=2.0.1-beta) +10 more potentially affected by CVE-2026-24014 via org.apache.iotdb:node-commons (>=1.3.3, <=2.0.7)

org.apache.iotdb:node-commons MAVEN version =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =2.0.1-beta - org.apache.iotdb:udf-example 1.3.3 Source cves: CVE-2026-24014 Source advisory: SNYK:JAVA-ORGAPACHEIOTDB-17824451...

syunity-meteo (0.1.0) potentially affected by CVE-2026-24014 via apache-iotdb (1.3.4)

apache-iotdb PYPI version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-iotdb and may be impacted: - syunity-meteo 0.1.0 Source cves: CVE-2026-24014 Source advisory: OSV:PYSEC-2026-2081...

syunity-meteo (0.1.0) potentially affected by CVE-2026-24012 via apache-iotdb (1.3.4)

apache-iotdb PYPI version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-iotdb and may be impacted: - syunity-meteo 0.1.0 Source cves: CVE-2026-24012 Source advisory: OSV:PYSEC-2026-2079...

PYSEC-2026-2080

Authentication Bypass by Spoofing vulnerability in Apache IoTDB.Certain Thrift RPC query handlers lack strict validation of the sessionIdparameter. An attacker can construct requests with a forged sessionId and,without performing openSession authentication, receive valid query results.This allows...