What is the CVSS score of CVE-2026-24713?

CVE-2026-24713 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Iotdb are affected by CVE-2026-24713?

A critical input validation vulnerability in Apache IoTDB (CVSS 9.8) affects versions 1.0.0-1.3.6 and 2.0.0-2.0.6, potentially allowing attackers to execute arbitrary code or compromise data…. A patch is available.

How to fix or mitigate CVE-2026-24713?

Within 24 hours: Identify and inventory all Apache IoTDB deployments and their versions; isolate or restrict network access to affected instances if possible. Within 7 days: Implement network segmentation and WAF rules to restrict untrusted input to IoTDB endpoints; consider disabling external-facing IoTDB services if business-critical. Within 30 days: Prepare upgrade plan to versions 1.3.7 or 2.0.7; monitor vendor security advisories for patch release and apply immediately upon availability; conduct post-patch vulnerability reassessment.

Iotdb CVE-2026-24713

CRITICAL

Improper Input Validation (CWE-20)

2026-03-09 security@apache.org

GHSA-6w48-2g9j-v9q5

Apache Iotdb

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

CVE Published

Mar 09, 2026 - 09:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Improper Input Validation vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.

Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.

AnalysisAI

Input validation vulnerability in Apache IoTDB from 1.0.0 before 1.3.7 and from 2.0.0 before 2.0.7. Second critical CVE affecting the IoT database.

Technical ContextAI

CWE-20 improper input validation. Second critical vulnerability in Apache IoTDB.

RemediationAI

Update to IoTDB 1.3.7 or 2.0.7.

More in Iotdb

View all

CVE-2024-24780 CRITICAL Act Now

9.8 May 14

Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. Rated critical severity (CVSS 9.8), this

CVE-2026-24015 CRITICAL Act Now

9.8 Mar 09

Vulnerability in Apache IoTDB from 1.0.0 before 1.3.7 and from 2.0.0 before 2.0.7. Critical severity issue in the IoT ti

CVE-2023-51656 CRITICAL Act Now

9.8 Dec 21

Deserialization of Untrusted Data vulnerability in Apache IoTDB.13.0 through 0.13.4. Rated critical severity (CVSS 9.8),

CVE-2023-24831 CRITICAL Act Now

9.8 Apr 17

Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.13.0 through 0.13.3. Rated critical sev

CVE-2020-1952 CRITICAL Act Now

9.8 Apr 27

An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. Rated critical severity (CVSS 9.8), this vulnerabil

CVE-2023-24829 HIGH This Week

8.8 Jan 31

Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.13.0 before 0.13.3. Rated high severity

CVE-2022-38369 HIGH This Week

8.8 Sep 05

Apache IoTDB version 0.13.0 is vulnerable by session id attack. Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2025-26864 HIGH This Week

7.5 May 14

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerabili

CVE-2025-26795 HIGH This Week

7.5 May 14

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerabili

CVE-2023-24830 HIGH This Week

7.5 Jan 30

Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.13.0 before 0.13.3. Rated high severity

CVE-2022-43766 HIGH This Week

7.5 Oct 26

Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untr

CVE-2022-38370 HIGH This Week

7.5 Sep 05

Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal

Same weakness CWE-20 – Improper Input Validation

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2024-3400 CRITICAL POC

10.0

CVE-2022-47966 CRITICAL POC

9.8

CVE-2023-22515 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2017-9791 CRITICAL POC

9.8

CVE-2017-15944 CRITICAL POC

9.8

CVE-2019-0604 CRITICAL POC

9.8

CVE-2026-24713 vulnerability details – vuln.today

Back

Iotdb CVE-2026-24713

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Iotdb

Same weakness CWE-20 – Improper Input Validation

Share

External POC / Exploit Code