What’s Vulnerable › Products

Apache Software Foundation Apache IoTDB vulnerabilities

34 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 24 published in the last 12 months.

Check whether your Apache Software Foundation Apache IoTDB version is affected

Latest Apache Software Foundation Apache IoTDB vulnerabilities

• CVE-2026-58663 — Apache IoTDB: Auth Bypass in pipeTransfer() interface
• CVE-2026-41114 — Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver
• CVE-2026-59229 — Apache IoTDB: Legacy Pipe Privilege Escalation
• CVE-2026-59562 — Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC
• CVE-2026-44630 — Apache IoTDB: RPC service denial of service via unchecked Thrift string length (CVSS 7.5)
• CVE-2026-40452 — Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users (CVSS 7.5)
• CVE-2026-40009 — Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor (CVSS 6.5)
• CVE-2026-40008 — Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC (CVSS 9.8)
• CVE-2026-40007 — Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowError (CVSS 7.5)
• CVE-2026-40006 — Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver (CVSS 7.5)
• CVE-2026-40005 — Apache IoTDB: Path Traversal in Pipe File Transfer Receiver (CVSS 9.1)
• CVE-2026-28564 — Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials (CVSS 9.8)
• CVE-2026-24014 — Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write (CVSS 9.8)
• CVE-2026-24013 — Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC (CVSS 9.1)
• CVE-2026-24012 — Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query (CVSS 7.5)
• CVE-2025-64152 — Apache IoTDB: Path Traversal Vulnerability (CVSS 9.1)
• CVE-2025-55017 — Apache IoTDB: Path Traversal Vulnerability (CVSS 9.1)
• CVE-2026-24713 — Apache IoTDB: JEXL Expression Injection Vulnerability (CVSS 9.8)
• CVE-2026-24015 — Apache IoTDB: Insecure Default Configuration Vulnerability (CVSS 9.8)
• CVE-2025-48459 — Apache IoTDB: Deserialization of untrusted Data (CVSS 5.3)
• CVE-2025-48392 — Apache IoTDB: DoS Vulnerability (CVSS 7.5)
• CVE-2025-26864 — Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication (CVSS 7.5)
• CVE-2025-26795 — Apache IoTDB JDBC driver: Exposure of Sensitive Information in IoTDB JDBC driver (CVSS 7.5)
• CVE-2024-24780 — Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function (CVSS 9.8)
• CVE-2023-46226 — Apache IoTDB: Remote Code Execution (RCE) risk via the UDF (CVSS 9.8)