Apache Iotdb vulnerabilities

• apache iotdb Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC CVE-2026-24013 Fix available 9.1 CriticalJuly 6, 2026
• apache iotdb Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query CVE-2026-24012 Fix available 7.5 HighJuly 6, 2026
• apache iotdb Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write CVE-2026-24014 Fix available 9.8 CriticalJuly 6, 2026
• apache iotdb Apache IoTDB: JEXL Expression Injection Vulnerability CVE-2026-24713 Fix available 9.8 CriticalMarch 9, 2026
• apache iotdb Apache IoTDB: Insecure Default Configuration Vulnerability CVE-2026-24015 Fix available 9.8 CriticalMarch 9, 2026
• apache iotdb Apache IoTDB: DoS Vulnerability CVE-2025-48392 Fix available 7.5 HighSeptember 24, 2025
• apache iotdb Apache IoTDB: Deserialization of untrusted Data CVE-2025-48459 Fix available 5.3 MediumSeptember 24, 2025
• apache iotdb Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication CVE-2025-26864 Fix available 7.5 HighMay 14, 2025
• apache iotdb, apache software foundation iotdb jdbc driver +1 more Apache IoTDB JDBC driver: Exposure of Sensitive Information in IoTDB JDBC driver CVE-2025-26795 Fix available 7.5 HighMay 14, 2025
• apache iotdb Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function CVE-2024-24780 Fix available 9.8 CriticalMay 14, 2025
• apache iotdb workbench Apache IoTDB Workbench: SSRF Vulnerability (EOL) CVE-2024-36448 7.3 HighAugust 5, 2024
• apache iotdb Apache IoTDB: Remote Code Execution (RCE) risk via the UDF CVE-2023-46226 Fix available 9.8 CriticalJanuary 15, 2024
• apache iotdb Apache IoTDB: Unsafe deserialize map in Sync Tool CVE-2023-51656 Fix available 9.8 CriticalDecember 21, 2023
• apache iotdb, apache software foundation iotdb workbench, apache iotdb web workbench +2 more Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench CVE-2023-30771 9.8 CriticalApril 17, 2023
• apache iotdb Apache IoTDB grafana-connector Login Bypass Vulnerability CVE-2023-24831 Fix available 9.8 CriticalApril 17, 2023
• apache iotdb, apache software foundation iotdb workbench +1 more Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench CVE-2023-24829 Fix available 8.8 HighJanuary 31, 2023
• apache iotdb, apache software foundation iotdb workbench +1 more Apache IoTDB Workbench: apache/iotdb-web-workbench: create a user without authorization CVE-2023-24830 Fix available 7.5 HighJanuary 30, 2023
• apache iotdb Apache IoTDB prior to 0.13.3 allows DoS CVE-2022-43766 Fix available 7.5 HighOctober 26, 2022
• apache iotdb No authorization of DatabaseConnectController in grafana-connector. CVE-2022-38370 Fix available 7.5 HighSeptember 5, 2022
• apache iotdb Login check vulnerability by session Id CVE-2022-38369 Fix available 8.8 HighSeptember 5, 2022
• apache iotdb, fasterxml jackson-databind, fedoraproject fedora +36 more +38 more XML External Entity (XXE) Injection in Jackson Databind CVE-2020-25649 Fix available EPSS 17.7% 7.5 HighOctober 14, 2020
• apache iotdb Improper Certificate Validation in Apache IoTDB CVE-2020-1952 Fix available 9.8 CriticalApril 27, 2020