Apache IoTDB: JEXL Expression Injection Vulnerability
Priority MEDIUM 50CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-917.
Summary
Improper Input Validation vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7. Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00734 54th percentileScored 2026-11-07
Fix Fixed Apache IoTDB (Apache Software Foundation): 1.3.7, 2.0.7org.apache.iotdb:iotdb-core (Maven): 1.3.7, 2.0.7
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache IoTDB | 1.0.0 to before 1.3.7; 2.0.0 to before 2.0.7 | 1.3.7, 2.0.7 | Patch available | CNA |
| — | org.apache.iotdb:iotdb-core (Maven) | 1.0.0 to before 1.3.7 | 1.3.7 | Patch available | GHSA-6w48-2g9j-v9q5 |
| — | org.apache.iotdb:iotdb-core (Maven) | 2.0.0 to before 2.0.7 | 2.0.7 | Patch available | GHSA-6w48-2g9j-v9q5 |
- Apache IoTDB VendorApache Affected 1.0.0 to before 1.3.7; 2.0.0 to before 2.0.7 Fixed in 1.3.7, 2.0.7 Patch available CNA
- org.apache.iotdb:iotdb-core (Maven) Vendor— Affected 1.0.0 to before 1.3.7 Fixed in 1.3.7 Patch available GHSA-6w48-2g9j-v9q5
- org.apache.iotdb:iotdb-core (Maven) Vendor— Affected 2.0.0 to before 2.0.7 Fixed in 2.0.7 Patch available GHSA-6w48-2g9j-v9q5
Remediation
- Fix · CNA Apache IoTDB (Apache Software Foundation) Fixed in 1.3.7, 2.0.7
- Fix · GHSA-6w48-2g9j-v9q5 org.apache.iotdb:iotdb-core (Maven) Fixed in 1.3.7 Advisory →
- Fix · GHSA-6w48-2g9j-v9q5 org.apache.iotdb:iotdb-core (Maven) Fixed in 2.0.7 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Apache IoTDB 1.3.7, 2.0.7
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2026-19352 Apache IoTDB: Insecure Default Configuration VulnerabilityPriority MEDIUM 50
Timeline
- 2026-10-02 Threatist record created from CVE-2026-24713
- 2026-10-03 Alias added: GHSA-6w48-2g9j-v9q5
- 2026-10-06 EPSS moved to the 50th–90th percentile
References
Advisory 3
Other 6
- https://github.com/apache/iotdb/commit/8fbfddc5f83771f1b339c457de597fe877f686d2
- https://github.com/apache/iotdb
- https://github.com/apache/iotdb/compare/v1.3.6...v1.3.7
- https://github.com/apache/iotdb/compare/v2.0.6...v2.0.7
- https://github.com/apache/iotdb/releases/tag/v1.3.7
- https://github.com/apache/iotdb/releases/tag/v2.0.7
More Apache Iotdb vulnerabilities
- TI-2020-15666 XML external entity injection in jackson-databind CVSS 3.1HIGH 7.5
- TI-2023-10331 Apache IoTDB grafana-connector Login Bypass Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2026-19352 Apache IoTDB: Insecure Default Configuration Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2026-19351 Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write CVSS 3.1CRITICAL 9.8
- TI-2026-19350 Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC CVSS 3.1CRITICAL 9.1
- TI-2023-24853 Apache IoTDB: Remote Code Execution (RCE) risk via the UDF CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-24713 · CVE Program
- CVE-2026-24713 · NVD
- FIRST EPSS
- GHSA-6w48-2g9j-v9q5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences