CVE-2026-24014

Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file write with the permissions of the IoTDB process. This issue affects Apache IoTDB: from 1.3.3 before 2.0.8. Users are recommended to upgrade to version 2.0.8, which fixes the issue.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/38298f803gb5j9nlhf0l9zkf34o90h3m	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/06/12	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) La interfaz RPC interna del DataNode de Apache IoTDB para crear instancias de Trigger utiliza el nombre del JAR de Trigger subido para construir una ruta de archivo sin validación suficiente. Si el puerto RPC interno del DataNode está expuesto a una red no confiable, un atacante puede usar secuencias de salto de ruta en el nombre del JAR para escribir archivos fuera del directorio de instalación de Trigger previsto. Esto podría permitir la escritura arbitraria de archivos con los permisos del proceso de IoTDB. Este problema afecta a Apache IoTDB: desde 1.3.3 antes de 2.0.8. Se recomienda a los usuarios actualizar a la versión 2.0.8, que corrige el problema.

Information

Published : 2026-07-06 09:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-24014

Mitre link : CVE-2026-24014

CVE.ORG link : CVE-2026-24014

JSON object : View

Products Affected

apache

iotdb

CWE

CWE-284

Improper Access Control

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2026-24014", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24014", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-06T19:08:49.734562Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache IoTDB", "versions": [{"status": "affected", "version": "1.3.3", "lessThan": "2.0.8", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-06T09:16:35.270", "references": [{"url": "https://lists.apache.org/thread/38298f803gb5j9nlhf0l9zkf34o90h3m", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/06/12", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Apache IoTDB DataNode\u2019s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file write with the permissions of the IoTDB process.\n\nThis issue affects Apache IoTDB: from 1.3.3 before 2.0.8.\n\nUsers are recommended to upgrade to version 2.0.8, which fixes the issue."}, {"lang": "es", "value": "La interfaz RPC interna del DataNode de Apache IoTDB para crear instancias de Trigger utiliza el nombre del JAR de Trigger subido para construir una ruta de archivo sin validaci\u00f3n suficiente. Si el puerto RPC interno del DataNode est\u00e1 expuesto a una red no confiable, un atacante puede usar secuencias de salto de ruta en el nombre del JAR para escribir archivos fuera del directorio de instalaci\u00f3n de Trigger previsto. Esto podr\u00eda permitir la escritura arbitraria de archivos con los permisos del proceso de IoTDB.\n\nEste problema afecta a Apache IoTDB: desde 1.3.3 antes de 2.0.8.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 2.0.8, que corrige el problema."}], "lastModified": "2026-10-25T15:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5DB00CF-13B9-44F8-9F24-70DFE24EB18E", "versionEndExcluding": "2.0.8", "versionStartIncluding": "1.3.3"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}