Skip to main content

Iotdb CVE-2026-24015

CRITICAL
Binding to an Unrestricted IP Address (CWE-1327)
2026-03-09 security@apache.org GHSA-74cf-pgh9-m5q2
Apache Iotdb
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
Analysis Generated
Mar 12, 2026 - 21:56 vuln.today
CVE Published
Mar 09, 2026 - 09:16 nvd
CRITICAL 9.8

DescriptionCVE.org

A vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.

Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.

AnalysisAI

Vulnerability in Apache IoTDB from 1.0.0 before 1.3.7 and from 2.0.0 before 2.0.7. Critical severity issue in the IoT time-series database platform.

Technical ContextAI

CWE-1327 in Apache IoTDB, a time-series database for IoT data. Affects versions 1.0.0-1.3.6 and 2.0.0-2.0.6.

RemediationAI

Update to IoTDB 1.3.7 or 2.0.7.

More in Iotdb

View all
CVE-2024-24780 CRITICAL
9.8 May 14

Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. Rated critical severity (CVSS 9.8), this

CVE-2026-24713 CRITICAL
9.8 Mar 09

Input validation vulnerability in Apache IoTDB from 1.0.0 before 1.3.7 and from 2.0.0 before 2.0.7. Second critical CVE

CVE-2023-51656 CRITICAL
9.8 Dec 21

Deserialization of Untrusted Data vulnerability in Apache IoTDB.13.0 through 0.13.4. Rated critical severity (CVSS 9.8),
CVE-2023-24831 CRITICAL
9.8 Apr 17

Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.13.0 through 0.13.3. Rated critical sev
CVE-2020-1952 CRITICAL
9.8 Apr 27

An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. Rated critical severity (CVSS 9.8), this vulnerabil
CVE-2023-24829 HIGH
8.8 Jan 31

Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.13.0 before 0.13.3. Rated high severity
CVE-2022-38369 HIGH
8.8 Sep 05

Apache IoTDB version 0.13.0 is vulnerable by session id attack. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2025-26864 HIGH
7.5 May 14

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerabili
CVE-2025-26795 HIGH
7.5 May 14

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerabili
CVE-2023-24830 HIGH
7.5 Jan 30

Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.13.0 before 0.13.3. Rated high severity
CVE-2022-43766 HIGH
7.5 Oct 26

Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untr
CVE-2022-38370 HIGH
7.5 Sep 05

Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal

Same weakness CWE-1327 – Binding to an Unrestricted IP Address

View all
CVE-2024-47176 MEDIUM POC
5.3
CVE-2026-0481 CRITICAL
9.2
CVE-2026-42503 HIGH
8.8
CVE-2023-41742 HIGH
7.5
CVE-2023-1968 HIGH
7.5
CVE-2026-21528 MEDIUM
6.5
CVE-2026-28395 MEDIUM
6.3
CVE-2024-36105 MEDIUM
5.3

Share

CVE-2026-24015 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy