p PatchFirst

CVE-2025-26864

CVE-2025-26864 · Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB. This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2. Users are recommended to upgrade to version 1.3.4 and 2.0.2, which fix the issue.

CVSS 7.5 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache iotdb

    Versions
    • ≥ 0.10.0, ≤ 1.3.3: Affected (semver)
    • ≥ 2.0.1-beta, < 2.0.2: Affected (semver)

    Update to 2.0.2

  • org.apache.iotdb:node-commons Maven

    Versions
    • 0.14.0-preview1
    • 0.14.0-preview2
    • 0.14.0-preview3
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.1.1
    • 1.1.2
    • 1.2.0
    • 1.2.1
    • 1.2.2
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.3.3
    Affected ranges
    • ECOSYSTEM: ≥ 0.10.0, < 1.3.4

    Update to 1.3.4

  • org.apache.iotdb:node-commons Maven

    Versions
    • 2.0.1-beta
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.1-beta, < 2.0.2

    Update to 2.0.2

  • apache-iotdb PyPI

    Versions
    • 0.10.0
    • 0.10.1
    • 0.11.0
    • 0.11.1
    • 0.11.2
    • 0.11.3
    • 0.11.4
    • 0.12.0
    • 0.12.1
    • 0.12.2
    • 0.12.3
    • 0.12.4
    • 0.12.5
    • 0.12.6
    • 0.13.0
    • 0.13.0.post1
    • 0.13.1
    • 0.13.2
    • 0.13.3
    • 0.13.5
    • 0.13.5.1
    • 0.14.0rc1
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.1.2
    • 1.2.0
    • 1.2.1
    • 1.3.0
    • 1.3.2
    • 1.3.2.post0
    • 1.3.3
    Affected ranges
    • ECOSYSTEM: ≥ 0.10.0, < 1.3.4

    Update to 1.3.4

  • apache-iotdb PyPI

    Versions
    • 2.0.1b0
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.1b0, < 2.0.2

    Update to 2.0.2

Original sources

Check your server →