Vulnerabilities

TI-2026-19350 CVE-2026-24013 · GHSA-qx5v-jm63-wqfj

Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC

MEDIUM 48

Authentication Bypass by Spoofing vulnerability in Apache IoTDB.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00635 Published 2026-07-06 Fixed in 2.0.8 CWE-290

TI-2026-19349 CVE-2026-24012 · GHSA-m38g-pffj-4hcr

Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query

MEDIUM 40

Uncontrolled Resource Consumption vulnerability in Apache IoTDB.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0074 Published 2026-07-06 Fixed in 2.0.8 CWE-400

TI-2026-19351 CVE-2026-24014 · GHSA-rpg4-r93p-w6gg

Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write

MEDIUM 50

Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0069 Published 2026-07-06 Fixed in 2.0.8 CWE-284

TI-2026-19926 CVE-2026-24713 · GHSA-6w48-2g9j-v9q5

Apache IoTDB: JEXL Expression Injection Vulnerability

MEDIUM 50

Improper Input Validation vulnerability in Apache IoTDB.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00734 Published 2026-03-09 Fixed in 1.3.7, 2.0.7 CWE-20

TI-2026-19352 CVE-2026-24015 · GHSA-74cf-pgh9-m5q2

Apache IoTDB: Insecure Default Configuration Vulnerability

MEDIUM 50

A vulnerability in Apache IoTDB.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00647 Published 2026-03-09 Fixed in 1.3.7, 2.0.7 CWE-1327

TI-2025-30717 CVE-2025-48392 · GHSA-vx84-xvr8-w24c

Apache IoTDB: DoS Vulnerability

LOW 34

A vulnerability in Apache IoTDB.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00627 Published 2025-09-24 Fixed in 2.0.5 CWE-400

TI-2025-30740 CVE-2025-48459 · GHSA-776q-jw43-fhjx

Apache IoTDB: Deserialization of untrusted Data

LOW 25

Deserialization of Untrusted Data vulnerability in Apache IoTDB.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00514 Published 2025-09-24 Fixed in 2.0.5 CWE-502

TI-2025-19735 CVE-2025-26864 · GHSA-5fc3-pqf2-57cx

Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication

MEDIUM 40

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00746 Published 2025-05-14 Fixed in 2.0.2, 1.3.4 CWE-200

TI-2025-19708 CVE-2025-26795 · GHSA-gp98-hfvm-2r4x

Apache IoTDB JDBC driver: Exposure of Sensitive Information in IoTDB JDBC driver

MEDIUM 40

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in Apache IoTDB JDBC driver.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00746 Published 2025-05-14 Fixed in 2.0.2, 1.3.4 CWE-200

TI-2024-16297 CVE-2024-24780 · GHSA-f4rq-f4j9-f6rm

Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function

MEDIUM 46

Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01437 Published 2025-05-14 Fixed in 1.3.4 CWE-94

TI-2023-24853 CVE-2023-46226 · GHSA-rxgg-273w-rfw7

Apache IoTDB: Remote Code Execution (RCE) risk via the UDF

MEDIUM 47

Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01917 Published 2024-01-15 Fixed in 1.3.0 CWE-94

TI-2023-28307 CVE-2023-51656 · GHSA-f23h-52hj-99p6

Apache IoTDB: Unsafe deserialize map in Sync Tool

MEDIUM 44

Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01035 Published 2023-12-21 Fixed in 1.2.2 CWE-502

TI-2023-10331 CVE-2023-24831 · GHSA-pvjv-386f-c8wh

Apache IoTDB grafana-connector Login Bypass Vulnerability

MEDIUM 51

Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through 0.13.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01222 Published 2023-04-17 Fixed in 0.13.4, 0.13.5 CWE-287

TI-2023-10329 CVE-2023-24829 · GHSA-98mx-4vv7-3pq6

Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench

MEDIUM 43

Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01245 Published 2023-01-31 Fixed in 0.13.3 CWE-863

TI-2023-10330 CVE-2023-24830

Apache IoTDB Workbench: apache/iotdb-web-workbench: create a user without authorization

MEDIUM 42

Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13.0 before 0.13.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01331 Published 2023-01-30 Fixed in 0.13.3 CWE-287

TI-2022-21500 CVE-2022-43766 · GHSA-g6hg-4v3c-6jq7

Apache IoTDB prior to 0.13.3 allows DoS

MEDIUM 42

Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01584 Published 2022-10-26 Fixed in 0.13.3 CWE-400

TI-2022-17997 CVE-2022-38370 · GHSA-c86f-9grv-pmqf

No authorization of DatabaseConnectController in grafana-connector.

LOW 36

Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01379 Published 2022-09-05 Fixed in 0.13.1 CWE-862

TI-2022-17996 CVE-2022-38369 · GHSA-g6vm-3ch8-c6jq

Login check vulnerability by session Id

MEDIUM 41

Apache IoTDB version 0.13.0 is vulnerable by session id attack.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01301 Published 2022-09-05 Fixed in 0.13.1 CWE-384

TI-2020-15666 CVE-2020-25649 · GHSA-288c-cq4h-88gq

XML external entity injection in jackson-databind

MEDIUM 56

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.17714 Published 2020-12-03 Partial fix · 2.6.7.4, 2.9.10.7 +1 CWE-611

TI-2020-01876 CVE-2020-1952 · GHSA-wc6f-cjcp-cc33

Improper certificate validation in Apache IoTDB

MEDIUM 47

An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02676 Published 2020-04-27 Fixed in 0.9.2 CWE-295

Vulnerabilities

Filters