CVE-2020-25649

The CVE-2020-25649 entry concerns a flaw in FasterXML Jackson Databind where entity expansion was not properly secured, enabling XML External Entity (XXE) attacks. This is a data-integrity risk. Connected advisories consistently associate the issue with Jackson Databind and XXE, and several sourc...

CVE-2020-1952

Summary: CVE-2020-1952 affects Apache IoTDB (versions 0.8.0–0.8.2 and 0.9.0–0.9.1). The issue is that the JMX port 31999 is exposed at startup without authentication, allowing remote code execution by an unauthenticated attacker. The connected documents corroborate the same description across mul...

CVE-2023-51656

CVE-2023-51656 concerns Apache IoTDB's Deserialization of Untrusted Data. The Red Hat/Veracode/CNVD/Sources show the vulnerability affects IoTDB releases 0.13.0–0.13.4 and can lead to arbitrary code execution via deserializing untrusted data. The issue is mitigated by upgrading to IoTDB 1.2.2, wh...

CVE-2023-46226

CVE-2023-46226 is an RCE issue in Apache IoTDB affecting 1.0.0–1.2.2. The vulnerability is tied to a UDF path/operation (as reflected across multiple sources) and is mitigated by upgrading to 1.3.0. Exploitation details are not provided in the supplied documents. Remediation: upgrade to IoTDB 1.3...

CVE-2024-24780

Apache IoTDB versions 1.0.0 through 1.3.3 are vulnerable to Remote Code Execution (RCE) due to a flaw in the User-defined Function (UDF) mechanism. An attacker with the privilege to create UDFs can register malicious functions from an untrusted URI , leading to arbitrary code execution. Users are...

CVE-2023-24830

CVE-2023-24830 affects Apache IoTDB, specifically the iotdb-web-workbench component (0.13.0 before 0.13.3). The issue is described as an improper authentication vulnerability that can allow a remote attacker to bypass authorization. The most concrete exploitation detail in the connected sources n...

CVE-2022-43766

CVE-2022-43766 affects Apache IoTDB versions 0.12.2–0.12.6 and 0.13.0–0.13.2. The issue is a Denial of Service caused by accepting untrusted REGEXP query patterns when running with Java 8, as described across multiple sources. The fixed release is 0.13.3 or newer, and using a later Java version a...

CVE-2022-38369

CVE-2022-38369 affects Apache IoTDB 0.13.0, vulnerable to a session-id attack (session fixation) that could allow an attacker to hijack a user session. The issue is mitigated by upgrading to IoTDB 0.13.1 . The NVD entry lists a high-severity impact with network exploitation, requiring user intera...

CVE-2022-38370

The CVE-2022-38370 issue affects the Apache IoTDB grafana-connector, specifically version 0.13.0, where an interface is exposed without authorization and can reveal internal database structures. The vulnerability is mitigated by upgrading to version 0.13.1, which addresses the issue. Connected so...

CVE-2023-24831

CVE-2023-24831 affects Apache IoTDB Grafana Connector (0.13.0–0.13.3). It is an improper authentication flaw allowing login without authorization. Fixed in 0.13.4. Remediation: upgrade to 0.13.4+; monitor advisories for patch availability.

CVE-2025-26864

The Apache IoTDB database (versions 0.10.0 through 1.3.3 and 2.0.1-beta before 2.0.2) is vulnerable to sensitive information exposure within the OpenIdAuthorizer component. The root cause is improper sanitization and logging of sensitive authentication data, where credentials or tokens are insert...

CVE-2023-24829

CVE-2023-24829 involves an Incorrect Authorization vulnerability in the iotdb-web-workbench component of Apache IoTDB. The issue affects iotdb-web-workbench from 0.13.0 up to versions before 0.13.3, and is fixed starting with 0.13.3. iotdb-web-workbench is an optional web console for IoTDB. Conse...

CVE-2025-26795

The Apache IoTDB JDBC driver is vulnerable to Sensitive Information Exposure due to improper sanitization and logging. Specifically, the iotdb-jdbc component may inadvertently write sensitive data, such as credentials or query contents , into log files without adequate masking or access controls....

CVE-2025-48392

Apache IoTDB contains a DoS vulnerability affecting 1.3.3–1.3.4 and 2.0.1-beta–2.0.4. The issue is fixed in 2.0.5. CVSS v3.1 metrics from NVD indicate HIGH impact with Availability loss (A=HIGH) and no confidentiality/integrity impact, network attack vector, low complexity, no auth required. Affe...

CVE-2026-24013

Apache IoTDB versions 1.3.3 through 2.0.7 are vulnerable to an Authentication Bypass by Spoofing vulnerability. The root cause is the lack of strict validation of the sessionId parameter within certain Thrift RPC query handlers . An attacker can construct requests with a forged sessionId to bypas...

CVE-2025-48459

CVE-2025-48459 concerns Apache IoTDB, where deserialization of untrusted data could be exploited via attacker-controlled serialized objects. Affected: IoTDB 1.0.0 up to, but not including, 2.0.5. Reports across multiple sources describe potential ability to execute arbitrary code or alter server ...

CVE-2026-24012

Apache IoTDB (versions 1.3.3 through 2.0.7 ) is vulnerable to an Uncontrolled Resource Consumption vulnerability in its aggregation query interface. The root cause is a failure to impose reasonable limits on the time span and aggregation interval of queries. An attacker can exploit this by constr...

CVE-2026-24014

Apache IoTDB versions 1.3.3 through 2.0.7 are vulnerable to a path traversal vulnerability in the DataNode’s internal RPC interface. When creating Trigger instances, the system fails to sufficiently validate the name of the uploaded Trigger JAR when constructing a file path. If the internal DataN...

CVE-2026-24015

CVE-2026-24015 (Apache IoTDB) affects IoTDB releases prior to 1.3.7 and prior to 2.0.7. Affected components include iotdb-server and related libraries (node-commons). Root cause described across sources is an insecure default configuration that allows binding to an unrestricted IP address, enabli...

CVE-2026-24713

CVE-2026-24713 relates to an improper input validation vulnerability in Apache IoTDB. Affected versions are 1.0.0 before 1.3.7 and 2.0.0 before 2.0.7. Upgrading to 1.3.7 or 2.0.7 is recommended as a fix. Some sources describe the impact as potentially enabling remote code execution through crafte...