Apache Iotdb
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_iotdb:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Iotdb (1a913d52-1fc7-5e0f-bbaa-a1ffd8a846cf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-59562 |
vulnerable | 2026-11-03 10:15:34.911009 |
Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC
Missing authentication for critical function vulnerability in Apache IoTDB.
This issue affects Apache IoTDB: from 2.0.0 before 2.0.11.
Users are recommended to upgrade to version 2.0.11, which fixes the issue.
Published: 2026-10-21T11:10:26.319Z
Updated: 2026-10-30T17:53:15.072Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-59229 |
vulnerable | 2026-11-03 10:15:34.549985 |
Apache IoTDB: Legacy Pipe Privilege Escalation
The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a
hardcoded SUPER_USER (root) identity when executing data loading and
deletion operations. A user with only SYSTEM-level privileges (such as
USE_PIPE or MAINTAIN) who does NOT have WRITE_DATA or DELETE_DATA
permissions on target databases can send specially crafted PipeData
messages through the Legacy Pipe API, resulting in data loading/deletion
operations executed as root — effectively bypassing IoTDB's permission
model entirely.
This issue affects Apache IoTDB: from 2.0.0 before 2.0.11.
Users are recommended to upgrade to version 2.0.11, which fixes the issue.
Published: 2026-10-21T11:11:46.924Z
Updated: 2026-10-30T13:33:53.498Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-58663 |
vulnerable | 2026-11-03 10:15:20.506628 |
Apache IoTDB: Auth Bypass in pipeTransfer() interface
An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service
This issue affects Apache IoTDB: from 2.0.0 before 2.0.11.
Users are recommended to upgrade to version 2.0.11, which fixes the issue.
Published: 2026-10-21T11:03:23.887Z
Updated: 2026-10-30T17:46:13.409Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44630 |
vulnerable | 2026-09-16 04:33:44.915249 |
Apache IoTDB: RPC service denial of service via unchecked Thrift string length
Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError.
This issue affects Apache IoTDB: before 1.3.8, from 2.0.0 before 2.0.9.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Published: 2026-08-10T09:25:11.899Z
Updated: 2026-08-12T15:54:05.223Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40452 |
vulnerable | 2026-07-29 00:49:30.129786 |
Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users
Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB.
Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users.
This issue affects Apache IoTDB: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Published: 2026-07-10T07:16:05.992Z
Updated: 2026-07-10T17:55:35.036Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40009 |
vulnerable | 2026-07-29 00:46:21.301084 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40008 |
vulnerable | 2026-07-29 00:46:21.300817 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40007 |
vulnerable | 2026-07-29 00:46:21.300663 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40006 |
vulnerable | 2026-07-29 00:46:21.300355 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40005 |
vulnerable | 2026-07-29 00:46:21.300105 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28564 |
vulnerable | 2026-07-29 00:37:43.444813 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24014 |
vulnerable | 2026-07-29 00:32:00.232858 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24013 |
vulnerable | 2026-07-29 00:32:00.232703 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24012 |
vulnerable | 2026-07-29 00:32:00.232403 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64152 |
vulnerable | 2026-07-29 00:09:54.454257 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-55017 |
vulnerable | 2026-07-29 00:01:31.614718 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24713 |
vulnerable | 2026-06-08 07:51:17.998503 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24015 |
vulnerable | 2026-06-08 07:51:16.533615 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-48459 |
vulnerable | 2026-06-08 07:27:15.952191 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-48392 |
vulnerable | 2026-06-08 07:27:15.780977 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-26864 |
vulnerable | 2026-06-08 07:14:50.583165 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-24780 |
vulnerable | 2026-06-08 06:29:41.712820 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-51656 |
vulnerable | 2026-06-08 06:17:53.687585 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-46226 |
vulnerable | 2026-06-08 06:12:44.438425 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-24831 |
vulnerable | 2026-06-08 05:56:06.295243 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-43766 |
vulnerable | 2026-06-08 05:49:33.993698 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-38370 |
vulnerable | 2026-06-08 05:47:16.168232 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-38369 |
vulnerable | 2026-06-08 05:47:16.167093 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.