EUVD-2026-42832
GHSA-xwqh-5v9q-g7v9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote and unauthenticated in effect, but replay requires first capturing a credential that should be invalid, so AC:H; full C/I/A impact on the database stands.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
6DescriptionCVE.org
Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credentials
This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Articles & Coverage 2
AnalysisAI
Authentication bypass via capture-replay in Apache IoTDB (1.0.0 through 2.0.9) lets attackers reuse stale credentials against the REST interface because Basic Authentication continues to accept cached credentials that should have been invalidated. An attacker who has captured or previously held valid credentials can keep authenticating after those credentials should have expired or been revoked, gaining full read/write control of the time-series database. No public exploit identified at time of analysis, and EPSS is low (0.18%, 8th percentile), so no active exploitation is indicated despite the 9.8 CVSS.
Technical ContextAI
Apache IoTDB is an open-source time-series database purpose-built for IoT and industrial telemetry workloads. The flaw is rooted in CWE-613 (Insufficient Session Expiration): the REST API's HTTP Basic Authentication layer caches credential-validation results and keeps honoring stale cached entries instead of re-validating against current, authoritative credential state. Because Basic Auth transmits credentials on every request, a captured credential set - or one whose backing account/password was later changed or revoked - remains accepted for as long as the cached entry persists. The CPE cpe:2.3:a:apache_software_foundation:apache_iotdb:*:*:*:*:*:*:*:* covers all affected 1.0.0-through-2.0.9 builds, and the capture-replay component means an on-path or credential-harvesting adversary can replay valid-looking authentication.
RemediationAI
Vendor-released patch: version 2.0.10 - upgrade every Apache IoTDB instance running any 1.0.0-through-2.0.9 build to 2.0.10 or later, per the Apache advisory (https://lists.apache.org/thread/l38wpy7flvvfwv4rkps87l5z8gprnfy0). Where immediate upgrade is not possible, reduce exposure by restricting network access to the REST endpoint (bind it to localhost or a management VLAN and block its port at the perimeter), which prevents remote replay at the cost of breaking remote REST clients; and terminate HTTP Basic Auth at a fronting reverse proxy or API gateway that enforces its own current-state validation and short-lived tokens, accepting the added operational component. After patching, rotate any credentials that may have been exposed while the stale-cache behavior was live, since prior captures could otherwise remain effective. Confirm the fix against the vendor thread rather than relying on version strings alone.
More in Apache Iotdb
View allUnsafe reflection in Apache IoTDB's pipe processor lets a user-supplied fully qualified Java class name be loaded and in
Arbitrary file write in Apache IoTDB DataNode (versions 1.3.3 up to but not including 2.0.8) allows attackers who can re
Arbitrary file write in Apache IoTDB (versions 1.0.0 through 2.0.9) lets remote attackers plant files anywhere the IoTDB
Denial of service in Apache IoTDB's Thrift-based RPC service allows remote unauthenticated attackers to crash the databa
Unauthenticated denial of service in Apache IoTDB (1.0.0 through 2.0.9) allows remote attackers to crash or degrade the
Denial of service in Apache IoTDB versions 1.3.3 through 2.0.7 lets remote attackers crash the DataNode process by submi
Authorization bypass in Apache IoTDB's REST API endpoint /rest/v2/fastLastQuery allows authenticated users to access las
Denial of service in Apache IoTDB versions 1.0.0 up to (but not including) 2.0.10 lets an unauthenticated network attack
Authentication bypass via sessionId spoofing in Apache IoTDB (1.3.3 through versions before 2.0.8) lets a remote, unauth
Privilege escalation in Apache IoTDB 2.0.8 through 2.0.9 allows any authenticated low-privilege user to rename their own
Path traversal in Apache IoTDB (1.0.0 before 1.3.6 and 2.0.0 before 2.0.7) allows remote attackers to read and write fil
Path traversal in Apache IoTDB (versions 1.0.0–1.3.5 and 2.0.0–2.0.5) lets remote unauthenticated attackers reference fi
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today