Apache IoTDB CVE-2026-40009

Exploitation requires a valid authenticated Apache IoTDB account on a server running an affected version (2.0.8 or 2.0.9) and the ability to invoke the user self-rename functionality; the concrete trigger is renaming one's own account to the reserved identity '__internal_auditor', which the system fails to protect. Limiting factors: the attacker must already possess working credentials (no anonymous/unauthenticated path is described), the target must be an unpatched 2.0.8-2.0.9 instance, and deployments that heavily restrict account creation or user-management privileges shrink the population of users able to perform the rename. There is no user-interaction or platform-specific dependency beyond the affected version range.

No CVSS vector, EPSS score, KEV entry, or POC was provided, so quantitative signals are absent and the assessment relies on the description and CWE. The prerequisite of an existing authenticated account meaningfully limits blast radius - this is a vertical privilege-escalation primitive, not an unauthenticated network compromise - but the payoff is severe: full tree-path access effectively defeats the entire per-user authorization model, exposing and potentially altering all time-series data. The mechanism (renaming to a known fixed reserved string) is trivially low-complexity and deterministic, so any actor with even minimal account access can reliably achieve escalation. Absent EPSS/KEV data, real-world exploitation likelihood is unquantified; treat this as a high-impact insider/post-authentication risk that is straightforward to weaponize once any account is obtained, rather than a mass-scanning internet threat. Because CVSS is N/A in the input, authentication qualifiers here are drawn from the explicit description ('Authenticated users'), not from a PR metric.

An attacker who holds any legitimate low-privilege IoTDB account - for example a contractor, a compromised application service account, or a curious internal user - issues a user-rename operation changing their own username to '__internal_auditor'. The system then treats them as the reserved auditor principal, granting full tree-path access to read and manipulate all time-series data across the database. No public exploit code is known, but the technique requires only a single documented rename command and no memory corruption or special tooling.