CVE-2024-24780

Apache IoTDB versions 1.0.0 through 1.3.3 are vulnerable to Remote Code Execution (RCE) due to a flaw in the User-defined Function (UDF) mechanism. An attacker with the privilege to create UDFs can register malicious functions from an untrusted URI , leading to arbitrary code execution. Users are...

CVE-2025-26864

The Apache IoTDB database (versions 0.10.0 through 1.3.3 and 2.0.1-beta before 2.0.2) is vulnerable to sensitive information exposure within the OpenIdAuthorizer component. The root cause is improper sanitization and logging of sensitive authentication data, where credentials or tokens are insert...

CVE-2025-26795

The Apache IoTDB JDBC driver is vulnerable to Sensitive Information Exposure due to improper sanitization and logging. Specifically, the iotdb-jdbc component may inadvertently write sensitive data, such as credentials or query contents , into log files without adequate masking or access controls....

CVE-2025-48392

Apache IoTDB contains a DoS vulnerability affecting 1.3.3–1.3.4 and 2.0.1-beta–2.0.4. The issue is fixed in 2.0.5. CVSS v3.1 metrics from NVD indicate HIGH impact with Availability loss (A=HIGH) and no confidentiality/integrity impact, network attack vector, low complexity, no auth required. Affe...

CVE-2025-48459

CVE-2025-48459 concerns Apache IoTDB, where deserialization of untrusted data could be exploited via attacker-controlled serialized objects. Affected: IoTDB 1.0.0 up to, but not including, 2.0.5. Reports across multiple sources describe potential ability to execute arbitrary code or alter server ...