CVE-2026-24015criticalCWE-1327

CVE-2026-24015: critical vulnerability in Apache IoTDB

Apache IoTDB: Insecure Default Configuration Vulnerability

Published · Updated

Follow this CVE+ Monitor Apache IoTDB+ Monitor org.apache.iotdb:iotdb-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.6%
In short

Apache IoTDB comes with unsafe default settings that allow attackers to access or control the database without proper authentication. This is critical because the database may contain sensitive data that needs protection.

Technical detail

IoTDB versions 1.0.0–1.3.6 and 2.0.0–2.0.6 contain insecure default configuration (CWE-1327) enabling unauthenticated or unauthorized access. The vulnerability affects database instances deployed with default settings; exploitation requires network access to the affected service. Successful exploitation compromises data confidentiality and integrity.

Summary generated and translated by AI from the official description.
A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7. Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache IoTDB
Related CVEs — Apache IoTDB

In the same product, most dangerous first.

CVE-2023-46226CRITICALApache IoTDB: Remote Code Execution (RCE) risk via the UDFEPSS 1.9%CVE-2022-43766HIGHApache IoTDB prior to 0.13.3 allows DoSEPSS 1.6%CVE-2024-24780CRITICALApache IoTDB: Remote Code Execution with untrusted URI of User-defined functionEPSS 1.4%CVE-2022-38370—No authorization of DatabaseConnectController in grafana-connector. EPSS 1.4%CVE-2022-38369—Login check vulnerability by session IdEPSS 1.3%CVE-2023-24831CRITICALApache IoTDB grafana-connector Login Bypass VulnerabilityEPSS 1.2%