Apache IoTDB CVE-2026-28564

Exploitation targets the Apache IoTDB REST interface specifically and requires the attacker to possess a credential the system should no longer honor - a captured/replayed Basic Auth credential, or one for an account whose password was changed or access revoked while a cached entry persists. The core limiting factor is that the attacker must first obtain valid-at-some-point credentials (via capture, replay, or prior legitimate access); this is not a bypass that fabricates access from nothing. Exploitation is further limited to deployments where the REST API is enabled and network-reachable, and the usable window depends on cache-entry lifetime. Patched environments (2.0.10+) are not exploitable.

The signals conflict and warrant nuance. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8 Critical) models this as trivially exploitable, remote, and unauthenticated with full C/I/A impact - but the vulnerability class (stale cached Basic Auth / capture-replay) inherently presumes the attacker already possesses credentials that were captured or should have been revoked, which is closer to an attack requirement than a true no-precondition network exploit; that is why the assessed vector below raises complexity to AC:H. Corroborating lower real-world urgency: EPSS is only 0.18% (8th percentile), there is no CISA KEV listing, and no public exploit code has been identified. Net: a genuine, patch-worthy authentication weakness - especially in environments that rotate or revoke credentials and expect immediate effect - but not an internet-wide mass-exploitation event. Prioritize based on whether IoTDB REST is network-exposed and whether credential rotation is part of your security model.

An attacker harvests a valid Apache IoTDB REST Basic Auth credential - from a logged request, a proxy, or a former employee's saved credentials. Even after the operator changes or revokes that account, the attacker replays the captured credential against the REST API and is still granted access due to the stale credential cache, then reads and manipulates time-series data. No public POC is currently identified, but the low-complexity replay nature makes exploitation straightforward once a credential is obtained.