EUVD-2026-42837
GHSA-hmrq-mg25-fh98
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable database service exploited by an authenticated low-privilege user (PR:L) via a deterministic rename (AC:L, no UI); escalation to full tree-path access yields high confidentiality, integrity, and availability impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor.
This issue affects Apache IoTDB: from 2.0.8 before 2.0.10.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Articles & Coverage 1
AnalysisAI
Privilege escalation in Apache IoTDB 2.0.8 through 2.0.9 allows any authenticated low-privilege user to rename their own account to the reserved '__internal_auditor' identity and thereby inherit full tree-path access across all stored time-series data. The flaw stems from the system trusting a reserved auditor username without protecting it from ordinary user-driven renames, so a normal database user can self-promote to auditor-level authority. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported and fixed by the Apache project in 2.0.10.
Technical ContextAI
Apache IoTDB is an open-source time-series database purpose-built for IoT and industrial telemetry workloads, organizing data hierarchically along storage groups and measurement 'tree paths' with a role/user permission model layered on top. The vulnerability is a CWE-269 Improper Privilege Management issue compounded by Improper Access Control: the system reserves a special principal named '__internal_auditor' that carries broad tree-path access, but the user-management logic fails to forbid a regular authenticated user from renaming their own account to that reserved name. Because access decisions key off the username/identity rather than an immutable internal role binding, adopting the reserved name grants the escalated authority. The single affected CPE is cpe:2.3:a:apache_software_foundation:apache_iotdb, confirming the Apache IoTDB server as the sole impacted product.
RemediationAI
Vendor-released patch: Apache IoTDB 2.0.10 - upgrade all 2.0.8 and 2.0.9 deployments to 2.0.10 or later, which fixes the reserved-name handling. Until the upgrade can be scheduled, reduce exposure by tightly restricting who can obtain authenticated accounts and by monitoring or auditing user-rename operations for any account attempting to take the '__internal_auditor' name; treat such a rename as a security event. Enforce least-privilege account provisioning and network-restrict the IoTDB service to trusted operators so the pool of potential attackers with valid credentials stays minimal - the trade-off is added administrative overhead and no guarantee of full protection, since these are compensating controls rather than a code fix. The authoritative advisory is https://lists.apache.org/thread/65hh7dh28rcxlzdzwdpt630321tr8b61.
More in Apache Iotdb
View allUnsafe reflection in Apache IoTDB's pipe processor lets a user-supplied fully qualified Java class name be loaded and in
Authentication bypass via capture-replay in Apache IoTDB (1.0.0 through 2.0.9) lets attackers reuse stale credentials ag
Arbitrary file write in Apache IoTDB DataNode (versions 1.3.3 up to but not including 2.0.8) allows attackers who can re
Arbitrary file write in Apache IoTDB (versions 1.0.0 through 2.0.9) lets remote attackers plant files anywhere the IoTDB
Denial of service in Apache IoTDB's Thrift-based RPC service allows remote unauthenticated attackers to crash the databa
Unauthenticated denial of service in Apache IoTDB (1.0.0 through 2.0.9) allows remote attackers to crash or degrade the
Denial of service in Apache IoTDB versions 1.3.3 through 2.0.7 lets remote attackers crash the DataNode process by submi
Authorization bypass in Apache IoTDB's REST API endpoint /rest/v2/fastLastQuery allows authenticated users to access las
Denial of service in Apache IoTDB versions 1.0.0 up to (but not including) 2.0.10 lets an unauthenticated network attack
Authentication bypass via sessionId spoofing in Apache IoTDB (1.3.3 through versions before 2.0.8) lets a remote, unauth
Path traversal in Apache IoTDB (1.0.0 before 1.3.6 and 2.0.0 before 2.0.7) allows remote attackers to read and write fil
Path traversal in Apache IoTDB (versions 1.0.0–1.3.5 and 2.0.0–2.0.5) lets remote unauthenticated attackers reference fi
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today