Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Apache IoTDB: Unsecured Class Instantiation via RPC

CVE-2026-40008 · published 4 months ago
Summary

Apache IoTDB versions 1.0.0 to 2.0.9 have a security weakness that allows an attacker to load and execute arbitrary Java code. This could potentially lead to unauthorized access or malicious actions. To fix this issue, upgrade to version 2.0.10.

What to do
  • Update apache software foundation apache iotdb to version 2.0.10 or later.
Affected software
VendorProductAffected versions
apache software foundation apache iotdb < 2.0.10
Original advisory text
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it usin...
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB.
The pipe processor reads a fully
qualified Java class name and
instantiates it using Class.forName().newInstance() without any
validation or allowlisting.


This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.

Users are recommended to upgrade to version 2.0.10, which fixes the issue.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Timeline
Published10 Jul 2026
Updated7 Nov 2026
First seen10 Jul 2026
Sources
CVE-2026-40008 · NVD
CVE-2026-40008 · MITRE
Track software like this
Free during beta