CVE-2026-24013

CriticalCVSS 9.1/10Last modified Oct 25, 2026

Description

Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attacker can construct requests with a forged sessionId and, without performing openSession authentication, receive valid query results. This allows authentication bypass and unauthorized reading of time-series data.

This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.

Users are recommended to upgrade to version 2.0.8, which fixes the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-290

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache IoTDB	>= 1.3.3, < 2.0.8

References

https://lists.apache.org/thread/6pwkgnqhbm56mvn309f87snm84s0b75yMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/06/11Mailing List, Third Party Advisory

Timeline

Published: Jul 6, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-240149.8Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path withou CVE-2026-240159.8A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7. Users are recommended CVE-2026-240168.4The installer of ServerView Agents for Windows provided by Fsas Technologies Inc. may insecurely load Dynamic Link Libraries. Arbitrary code CVE-2026-240178.1An Improper Control of Interaction Frequency vulnerability [CWE-799] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 CVE-2026-240187.8A UNIX symbolic link (Symlink) following vulnerability in Fortinet FortiClientLinux 7.4.0 through 7.4.4, FortiClientLinux 7.2.2 through 7.2.CVE-2026-24025.3CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the us CVE-2026-240275.3Crafted zones can lead to increased incoming network traffic.CVE-2026-240288.2An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketO CVE-2026-240296.5When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provide CVE-2026-24034.3CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting lo CVE-2026-240307.5An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resul CVE-2026-240318.2Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentic