Advisories · Technology

Apache Software Foundation Apache IoTDB.

Every CVE that names Apache Software Foundation Apache IoTDB among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-59229 CVE record

CVSS 8.8 High

Apache IoTDB: Legacy Pipe Privilege Escalation
- Apache Software Foundation Apache IoTDB
- Hard-coded credentials
Not analysed yet 21 Oct 2026
CVE-2026-59562 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC
- Apache Software Foundation Apache IoTDB
- Authentication bypass
Not analysed yet 21 Oct 2026
CVE-2026-58663 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache IoTDB: Auth Bypass in pipeTransfer() interface
- Apache Software Foundation Apache IoTDB
- Authentication bypass
Not analysed yet 21 Oct 2026
CVE-2026-44630 CVE record

CVSS 7.5 High

Apache IoTDB: RPC service denial of service via unchecked Thrift string length
- Apache Software Foundation Apache IoTDB
- Denial of service
Not analysed yet 10 Aug 2026
CVE-2026-40452 CVE record

CVSS 7.5 High

Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users
- Apache Software Foundation Apache IoTDB
- Broken access control
Not analysed yet 10 Jul 2026
CVE-2026-40009 CVE record

CVSS 6.5 Medium

Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor
- Apache Software Foundation Apache IoTDB
- Privilege escalation
- Broken access control
Not analysed yet 10 Jul 2026
CVE-2026-40008 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC
- Apache Software Foundation Apache IoTDB
- Code injection
Not analysed yet 10 Jul 2026
CVE-2026-40007 CVE record

CVSS 7.5 High

Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowError
- Apache Software Foundation Apache IoTDB
- Denial of service
Not analysed yet 10 Jul 2026
CVE-2026-40006 CVE record

CVSS 7.5 High

Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver
- Apache Software Foundation Apache IoTDB
- Authentication bypass
- Denial of service
Not analysed yet 10 Jul 2026
CVE-2026-40005 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache IoTDB: Path Traversal in Pipe File Transfer Receiver
- Apache Software Foundation Apache IoTDB
- Path traversal
Not analysed yet 10 Jul 2026
CVE-2026-28564 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials
- Apache Software Foundation Apache IoTDB
- Authentication bypass
Not analysed yet 10 Jul 2026