Advisoriesby IbisiotdbPYSEC-2026-2080
Authentication Bypass by Spoofing vulnerability in Apache IoTDB
Fix: upgrade to 2.0.8 or later
Authentication Bypass by Spoofing vulnerability in Apache IoTDB.
Certain Thrift RPC query handlers lack strict validation of the sessionId
parameter. An attacker can construct requests with a forged sessionId and,
without performing openSession authentication, receive valid query results.
This allows authentication bypass and unauthorized reading of time-series
data.
This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.
Users are recommended to upgrade to version 2.0.8, which fixes the issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-iotdb PyPI | >= 1.3.3, < 2.0.8 | 2.0.8 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Severity from
- the CVSS score
- Also known as
- CVE-2026-24013
More iotdb advisories
All iotdb
Uncontrolled Resource Consumption vulnerability in Apache IoTDBCVE-2026-24012fixed in 2.0.8iotdb: path traversalCVE-2026-24014fixed in 2.0.8Apache IoTDB: Deserialization of untrusted DataCVE-2025-48459fixed in 2.0.5Apache IoTDB Discloses Sensitive Information via Log FilesCVE-2025-26864fixed in 1.3.4 +1Apache IoTDB Vulnerable to Remote Code ExecutionCVE-2024-24780fixed in 1.3.4Remote Code Execution vulnerability in Apache IoTDB via UDFCVE-2023-46226fixed in 1.3.0