CVE-2026-24013

Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attacker can construct requests with a forged sessionId and, without performing openSession authentication, receive valid query results. This allows authentication bypass and unauthorized reading of time-series data. This issue affects Apache IoTDB: from 1.3.3 before 2.0.8. Users are recommended to upgrade to version 2.0.8, which fixes the issue.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/6pwkgnqhbm56mvn309f87snm84s0b75y	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/06/11	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de omisión de autenticación por suplantación en Apache IoTDB. Ciertos manejadores de consultas Thrift RPC carecen de validación estricta del parámetro sessionId. Un atacante puede construir solicitudes con un sessionId falsificado y, sin realizar la autenticación openSession, recibir resultados de consulta válidos. Esto permite la omisión de autenticación y la lectura no autorizada de datos de series temporales. Este problema afecta a Apache IoTDB: desde 1.3.3 antes de 2.0.8. Se recomienda a los usuarios actualizar a la versión 2.0.8, que corrige el problema.

Information

Published : 2026-07-06 09:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-24013

Mitre link : CVE-2026-24013

CVE.ORG link : CVE-2026-24013

JSON object : View

Products Affected

apache

iotdb

CWE

CWE-290

Authentication Bypass by Spoofing

{"id": "CVE-2026-24013", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24013", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-06T19:10:47.800876Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache IoTDB", "versions": [{"status": "affected", "version": "1.3.3", "lessThan": "2.0.8", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-06T09:16:35.163", "references": [{"url": "https://lists.apache.org/thread/6pwkgnqhbm56mvn309f87snm84s0b75y", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/06/11", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "Authentication Bypass by Spoofing vulnerability in Apache IoTDB.\nCertain Thrift RPC query handlers lack strict validation of the sessionId\nparameter. An attacker can construct requests with a forged sessionId and,\nwithout performing openSession authentication, receive valid query results.\nThis allows authentication bypass and unauthorized reading of time-series\ndata.\n\n\nThis issue affects Apache IoTDB: from 1.3.3 before 2.0.8.\n\nUsers are recommended to upgrade to version 2.0.8, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n por suplantaci\u00f3n en Apache IoTDB.\nCiertos manejadores de consultas Thrift RPC carecen de validaci\u00f3n estricta del par\u00e1metro sessionId. Un atacante puede construir solicitudes con un sessionId falsificado y, sin realizar la autenticaci\u00f3n openSession, recibir resultados de consulta v\u00e1lidos. Esto permite la omisi\u00f3n de autenticaci\u00f3n y la lectura no autorizada de datos de series temporales.\n\nEste problema afecta a Apache IoTDB: desde 1.3.3 antes de 2.0.8.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 2.0.8, que corrige el problema."}], "lastModified": "2026-10-25T15:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5DB00CF-13B9-44F8-9F24-70DFE24EB18E", "versionEndExcluding": "2.0.8", "versionStartIncluding": "1.3.3"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}