Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Apache IoTDB: Stale Login Credentials Accepted

CVE-2026-28564 · published 4 months ago
Summary

Apache IoTDB, a database for IoT data, has a security issue that allows attackers to use old login credentials. This means that if someone steals your login information, they can keep using it even after you've changed your password. To fix this, update Apache IoTDB to version 2.0.10 or later.

What to do
  • Update apache software foundation apache iotdb to version 2.0.10 or later.
Affected software
VendorProductAffected versions
apache software foundation apache iotdb < 2.0.10
Original advisory text
Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credentials This issue affects Apache IoTDB:...
Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB.
REST Basic Authentication Accepts Stale Cached Credentials


This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.

Users are recommended to upgrade to version 2.0.10, which fixes the issue.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-613Insufficient Session Expiration
CWE-294Authentication Bypass by Capture-replay
Timeline
Published10 Jul 2026
Updated7 Nov 2026
First seen10 Jul 2026
Sources
CVE-2026-28564 · NVD
CVE-2026-28564 · MITRE
Track software like this
Free during beta