CVE-2023-46226: Apache IoTDB: Remote Code Execution (RCE) risk via the UDF

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-15 · updated 2026-06-17
Weakness: CWE-94

Description

Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2. Users are recommended to upgrade to version 1.3.0, which fixes the issue.

Affected products

Apache Software Foundation Apache IoTDB: from 1.0.0 before 1.3.0 — fixed in 1.3.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache IoTDB 1.3.0. Check the vendor advisory for mitigations.

References

http://www.openwall.com/lists/oss-security/2024/01/15/1
https://lists.apache.org/thread/293b4ob65ftnfwyf62fb9zh8gwdy38hg
http://www.openwall.com/lists/oss-security/2024/01/15/1
https://lists.apache.org/thread/293b4ob65ftnfwyf62fb9zh8gwdy38hg

Get alerted when CVE-2023-46226 or the next vulnerability affects your stack