Critical severity · published Jul 6, 2026
CVE-2026-24013
Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC
9.1
CVSS
0.6%
EPSS
No
On KEV
Description
Authentication Bypass by Spoofing vulnerability in Apache IoTDB.
Certain Thrift RPC query handlers lack strict validation of the sessionId
parameter. An attacker can construct requests with a forged sessionId and,
without performing openSession authentication, receive valid query results.
This allows authentication bypass and unauthorized reading of time-series
data.
This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.
Users are recommended to upgrade to version 2.0.8, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Apache IoTDB · Apache Software Foundation
1.3.3 before 2.0.8 · source: vendor
IO
Iotdb · Apache
1.3.3 before 2.0.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24013
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24013
Mailing List
https://lists.apache.org/thread/6pwkgnqhbm56mvn309f87snm84s0b75y
Mailing List
http://www.openwall.com/lists/oss-security/2026/07/06/11
More from Apache IoTDB
9.8
CVE-2026-40008
Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC
9.8
CVE-2026-28564
Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials
9.8
CVE-2026-24014
Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write
9.8
CVE-2026-24713
Apache IoTDB: JEXL Expression Injection Vulnerability
9.8
CVE-2026-24015
Apache IoTDB: Insecure Default Configuration Vulnerability