Sign in
Deutsch English Español Polski
Critical

Authentication Bypass by Spoofing vulnerability in Apache IoTDB.

  • Disclosed: 06.07.2026
  • Updated: 11.10.2026 13:19

Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attacker can construct requests with a forged sessionId and, without performing openSession authentication, receive valid query results. This allows authentication bypass and unauthorized reading of time-series data.

This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.

Users are recommended to upgrade to version 2.0.8, which fixes the issue.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) apache-iotdb >= 1.3.3, < 2.0.8 2.0.8

References

CVSS score 9.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE)
-
Platform
Python (PyPI)
Package
apache-iotdb
Disclosed
06.07.2026
Updated
11.10.2026 13:19

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-2080 - PyPA Advisory Database; CC BY 4.0

Vulnerability history: apache-iotdb

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (12) in the archive
Total entries
12
First → latest
09.2022 07.2026
Without a fix
1
Exploited in attacks
0

Severity breakdown

  • Critical 5
  • High 3
  • Medium 2
  • Unrated 2

Disclosures per year

Severity:
  1. Uncontrolled Resource Consumption vulnerability in Apache IoTDB. 
    High · 7.5 CVE-2026-24012 >= 1.3.3, < 2.0.8 2.0.8
  2. Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port i
    Critical · 9.8 CVE-2026-24014 >= 1.3.3, < 2.0.8 2.0.8
  3. Authentication Bypass by Spoofing vulnerability in Apache IoTDB. this entry
    Critical · 9.1 CVE-2026-24013 >= 1.3.3, < 2.0.8 2.0.8
  4. Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI.
    Critical · 9.8 CVE-2024-24780 >= 1.0.0, < 1.3.4 1.3.4
  5. Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2.
    Critical · 9.8 CVE-2023-46226 >= 1.0.0, < 1.3.0 1.3.0
  6. Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through 0.13.3.
    Critical · 9.8 CVE-2023-24831 >= 0.13.0, < 0.13.5 0.13.5
  7. Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. Users should upgrade to 0.13.3 wh
    High · 7.5 CVE-2022-43766 >= 0.12.2, < 0.13.3 0.13.3
  8. Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.
    High · 8.8 CVE-2022-38369 < 0.13.1 0.13.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.