iotdbGHSA-5fc3-pqf2-57cx
Apache IoTDB Discloses Sensitive Information via Log Files
MediumCVE-2025-26864 · Published May 14, 2025 · updated Jul 2, 2025
Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB. This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2. Users are recommended to upgrade to version 1.3.4 and 2.0.2, which fix the issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-iotdb PyPI | >= 0.10.0, < 1.3.4 | 1.3.4 |
| >= 2.0.1b0, < 2.0.2 | 2.0.2 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200
- Also known as
- CVE-2025-26864, PYSEC-2025-60
- nvd.nist.gov/vuln/detail/CVE-2025-26864
- github.com/apache/iotdb/pull/14863
- github.com/apache/iotdb/commit/34fcaff6b72470d5ad369307dde7fae8897aea7e
- github.com/apache/iotdb
- github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2025-60.yaml
- lists.apache.org/thread/2kcjnlypppk8qjh17dpz0jvkcpn6l162
- www.openwall.com/lists/oss-security/2025/05/14/4
More iotdb advisories
All iotdb| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 6 | iotdb: path traversal Critical9.8Jul 6 | Critical9.8 | 2.0.8 |
| Jul 6 | Authentication Bypass by Spoofing vulnerability in Apache IoTDBCritical9.1Jul 6 | Critical9.1 | 2.0.8 |
| Jul 6 | Uncontrolled Resource Consumption vulnerability in Apache IoTDBHigh7.5Jul 6 | High7.5 | 2.0.8 |
| Sep 242025 | Apache IoTDB: Deserialization of untrusted DataCritical5.3Sep 24, 2025 | Critical5.3 | 2.0.5 |
| May 142025 | Apache IoTDB Vulnerable to Remote Code ExecutionCritical9.8May 14, 2025 | Critical9.8 | 1.3.4 |
| Jan 152024 | Remote Code Execution vulnerability in Apache IoTDB via UDFHigh9.8Jan 15, 2024 | High9.8 | 1.3.0 |