Advisoriesby IbisiotdbGHSA-5fc3-pqf2-57cx
Apache IoTDB Discloses Sensitive Information via Log Files
Fix: upgrade to 1.3.4 or later (2 fixed versions below)
Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB.
This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2.
Users are recommended to upgrade to version 1.3.4 and 2.0.2, which fix the issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-iotdb PyPI | >= 0.10.0, < 1.3.4 | 1.3.4 |
| >= 2.0.1b0, < 2.0.2 | 2.0.2 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200
- Also known as
- CVE-2025-26864, PYSEC-2025-60
- nvd.nist.gov/vuln/detail/CVE-2025-26864
- github.com/apache/iotdb/pull/14863
- github.com/apache/iotdb/commit/34fcaff6b72470d5ad369307dde7fae8897aea7e
- github.com/apache/iotdb
- github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2025-60.yaml
- lists.apache.org/thread/2kcjnlypppk8qjh17dpz0jvkcpn6l162
- www.openwall.com/lists/oss-security/2025/05/14/4
More iotdb advisories
All iotdb
iotdb: path traversalCVE-2026-24014fixed in 2.0.8Authentication Bypass by Spoofing vulnerability in Apache IoTDBCVE-2026-24013fixed in 2.0.8Uncontrolled Resource Consumption vulnerability in Apache IoTDBCVE-2026-24012fixed in 2.0.8Apache IoTDB: Deserialization of untrusted DataCVE-2025-48459fixed in 2.0.5Apache IoTDB Vulnerable to Remote Code ExecutionCVE-2024-24780fixed in 1.3.4Remote Code Execution vulnerability in Apache IoTDB via UDFCVE-2023-46226fixed in 1.3.0