Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-24013: Apache IoTDB lets attackers read data without login
CVE-2026-24013 · published 4 months ago
Summary
Versions of Apache IoTDB from 1.3.3 up to 2.0.7 do not properly check a session identifier in certain remote calls, so an attacker can fake a session and retrieve time‑series data without authenticating. This could expose sensitive sensor or operational information. Upgrade to Apache IoTDB 2.0.8 or later to close the gap.
What to do
- Update apache software foundation apache iotdb to version 2.0.8 or later.
- Update apache iotdb to version 2.0.8 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| apache software foundation | apache iotdb | < 2.0.8 |
| apache | iotdb |
>= 1.3.3, < 2.0.8 cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:* |
Original advisory text
Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC
Authentication Bypass by Spoofing vulnerability in Apache IoTDB.
Certain Thrift RPC query handlers lack strict validation of the sessionId
parameter. An attacker can construct requests with a forged sessionId and,
without performing openSession authentication, receive valid query results.
This allows authentication bypass and unauthorized reading of time-series
data.
This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.
Users are recommended to upgrade to version 2.0.8, which fixes the issue.
Certain Thrift RPC query handlers lack strict validation of the sessionId
parameter. An attacker can construct requests with a forged sessionId and,
without performing openSession authentication, receive valid query results.
This allows authentication bypass and unauthorized reading of time-series
data.
This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.
Users are recommended to upgrade to version 2.0.8, which fixes the issue.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24013... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-24013 Vendor Advisory
- https://lists.apache.org/thread/6pwkgnqhbm56mvn309f87snm84s0b75y Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/07/06/11 URL
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.1
Critical
Type
CWE-290Authentication Bypass by Spoofing
Timeline
Published6 Jul 2026
Updated7 Nov 2026
First seen6 Jul 2026
Track software like this
Free during beta