EUVD-2026-41857
GHSA-qx5v-jm63-wqfj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach IoTDB Thrift RPC port
-
DeliveryCraft query with forged sessionId
-
ExploitBypass openSession authentication
-
ExecutionHandler returns valid results
-
ImpactExfiltrate time-series data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Apache IoTDB Thrift RPC service and the ability to send RPC requests to one of the affected query handlers carrying a forged sessionId; no valid credentials and no prior openSession call are needed (PR:N, no authentication). The limiting factors are: the target must run a vulnerable version (1.3.3 through 2.0.7), the Thrift RPC endpoint must be network-reachable by the attacker (deployments that firewall this port to trusted clients materially reduce exposure), and per the description the demonstrated impact is limited to reading time-series data through query handlers rather than full administrative control. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N, score 9.1) describes a trivially reachable, network-based, unauthenticated attack - a genuinely high-severity signal. However, the signals conflict on breadth and impact: EPSS is only 0.20% (10th percentile), the CVE is not on CISA KEV, and no POC is referenced, indicating no observed mass exploitation. There is also an impact discrepancy worth flagging - the description states only that an attacker can 'receive valid query results' and perform 'unauthorized reading of time-series data,' which supports a confidentiality impact (C:H) but does NOT substantiate the I:H integrity impact asserted in the published vector; verify with the vendor whether the bypass also permits writes/deletes. Net assessment: for organizations actually running IoTDB with the Thrift RPC port exposed to untrusted networks, this is a real priority (unauthenticated data disclosure), but the low EPSS and absence of KEV/POC suggest opportunistic mass exploitation is not yet occurring. |
| Exploit ScenarioDerived | An attacker with network reachability to the IoTDB Thrift RPC port crafts a query RPC populated with a forged sessionId, skipping the normal openSession authentication step entirely. The affected handler processes the request as if authenticated and returns time-series query results, letting the attacker exfiltrate sensor and telemetry data. Because the vector is AV:N/AC:L/PR:N/UI:N, this requires only network access and no credentials or user interaction, though no public POC is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 06, 2026
Authentication bypass via sessionId spoofing in Apache IoTDB (1.3.3 through versions before 2.0.8) lets a remote, unauthenticated attacker forge the sessionId parameter on certain Thrift RPC query handlers and retrieve valid query results without ever calling openSession. This exposes stored time-series data to arbitrary readers. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile) despite the 9.1 CVSS, so exploitation is not confirmed in the wild.
Earlier versions of this analysis (2)
Authentication bypass by spoofing in Apache IoTDB versions 1.3.3 through 2.0.7 lets remote unauthenticated attackers read time-series data without ever calling openSession, because certain Thrift RPC query handlers fail to validate the sessionId parameter. By forging a sessionId, an attacker receives valid query results directly, exposing potentially sensitive industrial and IoT telemetry. No public exploit is identified at time of analysis and EPSS is low (0.20%), but the network-reachable, unauthenticated nature makes this a high-priority patch.
Authentication bypass in Apache IoTDB's Thrift RPC interface allows unauthenticated remote attackers to read arbitrary time-series data by forging a sessionId parameter. Affected versions 1.3.3 through 2.0.7 expose certain Thrift RPC query handlers that fail to validate sessionId authenticity, enabling an attacker to skip the openSession handshake entirely and receive valid query results. No public exploit has been identified at time of analysis, but the straightforward nature of the bypass - crafting a spoofed sessionId - makes exploitation feasible without specialized tooling.
RemediationAI
Vendor-released patch: upgrade Apache IoTDB to version 2.0.8, which the Apache project states fixes the issue - this is the primary and recommended remediation. Where an immediate upgrade is not feasible, reduce exposure by restricting network access to the IoTDB Thrift RPC service port (default 6667) to trusted client hosts only via firewall or security-group rules, and place the database behind a VPN or bastion rather than on any untrusted or internet-facing segment; note this does not fix the underlying bypass and offers no protection against an attacker already inside the trusted network. Consult the Apache advisory (https://lists.apache.org/thread/6pwkgnqhbm56mvn309f87snm84s0b75y) and the oss-security disclosure (https://seclists.org/oss-sec/2026/q3/68) before deploying.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache IoTDB is an open-source time-series database purpose-built for IoT and industrial sensor telemetry, exposing its client API over an Apache Thrift RPC service. Sessions are normally established through an openSession call that authenticates the client and issues a sessionId used on all subsequent RPC calls. This flaw is a CWE-290 (Authentication Bypass by Spoofing): specific Thrift query handlers trust the caller-supplied sessionId without verifying it corresponds to an authenticated, server-issued session, so a client can present a fabricated identifier and be treated as a valid session. The root cause is missing server-side session-state validation on those RPC entry points rather than a cryptographic or transport weakness.
Know when Apache Iotdb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network RPC with no interaction gives AV:N/AC:L/PR:N/UI:N; description substantiates only data reading, so C:H but I:N/A:N.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attacker can construct requests with a forged sessionId and, without performing openSession authentication, receive valid query results. This allows authentication bypass and unauthorized reading of time-series data.
This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.
Users are recommended to upgrade to version 2.0.8, which fixes the issue.
Articles & Coverage 1
Executive ViewAI
Apache IoTDB versions 1.3.3 through 2.0.7 contain a critical authentication bypass allowing unauthenticated remote access to time-series databases through sessionId spoofing. Any attacker can query and retrieve stored data without credentials, directly exposing sensitive operational metrics and historical data. Immediate patching is required despite low current exploitation activity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Apache Iotdb
View allUnsafe reflection in Apache IoTDB's pipe processor lets a user-supplied fully qualified Java class name be loaded and in
Authentication bypass via capture-replay in Apache IoTDB (1.0.0 through 2.0.9) lets attackers reuse stale credentials ag
Arbitrary file write in Apache IoTDB DataNode (versions 1.3.3 up to but not including 2.0.8) allows attackers who can re
Arbitrary file write in Apache IoTDB (versions 1.0.0 through 2.0.9) lets remote attackers plant files anywhere the IoTDB
Denial of service in Apache IoTDB's Thrift-based RPC service allows remote unauthenticated attackers to crash the databa
Unauthenticated denial of service in Apache IoTDB (1.0.0 through 2.0.9) allows remote attackers to crash or degrade the
Denial of service in Apache IoTDB versions 1.3.3 through 2.0.7 lets remote attackers crash the DataNode process by submi
Authorization bypass in Apache IoTDB's REST API endpoint /rest/v2/fastLastQuery allows authenticated users to access las
Denial of service in Apache IoTDB versions 1.0.0 up to (but not including) 2.0.10 lets an unauthenticated network attack
Privilege escalation in Apache IoTDB 2.0.8 through 2.0.9 allows any authenticated low-privilege user to rename their own
Path traversal in Apache IoTDB (1.0.0 before 1.3.6 and 2.0.0 before 2.0.7) allows remote attackers to read and write fil
Path traversal in Apache IoTDB (versions 1.0.0–1.3.5 and 2.0.0–2.0.5) lets remote unauthenticated attackers reference fi
Exploit-DB