p PatchFirst

CVE-2026-24013

CVE-2026-24013 · Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attacker can construct requests with a forged sessionId and, without performing openSession authentication, receive valid query results. This allows authentication bypass and unauthorized reading of time-series data. This issue affects Apache IoTDB: from 1.3.3 before 2.0.8. Users are recommended to upgrade to version 2.0.8, which fixes the issue.

CVSS 9.1 · Critical · EPSS 0.6% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache iotdb

    Versions
    • ≥ 1.3.3, < 2.0.8: Affected (semver)

    Update to 2.0.8

  • apache-iotdb PyPI

    Versions
    • 1.3.3
    • 1.3.4
    • 2.0.1b0
    • 2.0.2
    • 2.0.3
    • 2.0.4
    • 2.0.4.dev0
    • 2.0.5
    • 2.0.6
    Affected ranges
    • ECOSYSTEM: ≥ 1.3.3, < 2.0.8

    Update to 2.0.8

Original sources

Check your server →