EUVD-2026-42836
GHSA-v4p4-86j5-2f8q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and low-complexity, but defining a pipe processor is an authenticated operation so PR:L; unsafe reflection yields code execution with full CIA impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
7DescriptionCVE.org
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting.
This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Articles & Coverage 3
AnalysisAI
Unsafe reflection in Apache IoTDB's pipe processor lets a user-supplied fully qualified Java class name be loaded and instantiated via Class.forName().newInstance() with no allowlisting, enabling arbitrary class loading and likely remote code execution in the database server process. It affects all releases from 1.0.0 up to (but not including) 2.0.10 and is fixed in 2.0.10. No public exploit identified at time of analysis, and EPSS is low (0.25%, 17th percentile), though CISA SSVC rates the technical impact as total and considers exploitation automatable.
Technical ContextAI
Apache IoTDB is an open-source time-series database aimed at IoT and industrial telemetry workloads, running on the JVM. The affected component is the pipe subsystem, IoTDB's stream-processing/data-synchronization feature, where a pipe can be configured with a custom 'processor' plugin identified by class name. The root cause is CWE-470 (Use of Externally-Controlled Input to Select Classes or Code, 'Unsafe Reflection'): the processor name is passed directly to reflective instantiation (Class.forName(name).newInstance()) without validation, type-checking against an expected interface, or an allowlist of permitted classes. This lets an attacker who controls that input coerce the JVM into loading and constructing arbitrary classes present on the classpath, whose constructors or static initializers can execute attacker-influenced logic. The single CPE cpe:2.3:a:apache_software_foundation:apache_iotdb:*:*:*:*:*:*:*:* confirms the product scope without version bounding in the CPE string itself.
RemediationAI
Vendor-released patch: 2.0.10 - upgrade Apache IoTDB to 2.0.10, which adds validation/allowlisting to the pipe processor class loading, per the Apache advisory (https://lists.apache.org/thread/fm8cpvzbox2qqy99ztglm8wkk1nrg9ng). If immediate upgrade is not possible, restrict who can create or alter pipes by tightening IoTDB authentication and authorization so that only trusted administrators hold pipe-management privileges, and avoid exposing the IoTDB service ports to untrusted networks (place them behind a firewall or restrict to a management VLAN); the trade-off is reduced convenience for legitimate data-sync automation and no protection against an already-privileged malicious insider. Monitor pipe definitions for unexpected or non-standard processor class names as a detective control until patched.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today