EUVD-2026-42838
GHSA-xxj7-h37p-p48c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible REST API (AV:N), low complexity, requires valid credentials (PR:L), read-only last-value data disclosure with no integrity or availability impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users.
This issue affects Apache IoTDB: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Articles & Coverage 1
AnalysisAI
Authorization bypass in Apache IoTDB's REST API endpoint /rest/v2/fastLastQuery allows authenticated users to access last-value time-series data they are not authorized to view. Affected versions span the 1.3.x branch (1.3.5 through 1.3.7) and the 2.0.x branch (2.0.5 through 2.0.9). No public exploit code or active exploitation has been identified at time of analysis, but the REST interface nature of the flaw means any valid credential holder can attempt unauthorized data retrieval without elevated privilege.
Technical ContextAI
Apache IoTDB is an IoT-oriented time-series database designed for high-throughput sensor and telemetry data storage. The affected component is the REST v2 API's fastLastQuery endpoint, which returns the most recent recorded value for queried time-series. The root cause is classified as CWE-863 (Incorrect Authorization) - a failure to correctly verify that an authenticated principal possesses the required authorization for a requested resource or operation, distinct from authentication failure. The CPE string (cpe:2.3:a:apache_software_foundation:apache_iotdb:*:*:*:*:*:*:*:*) confirms the flaw spans the Apache Software Foundation's mainline IoTDB product across both the 1.3.x and 2.0.x release trains. The REST v2 API is a modern interface layer added to IoTDB for programmatic data access, meaning this endpoint is likely used by automated clients and integrations rather than only interactive users.
RemediationAI
Upgrade to Apache IoTDB version 2.0.10 or later, which is confirmed by the vendor to fix this issue. For users on the 1.3.x branch, upgrade to 1.3.8 or later is implied by the stated affected range (before 1.3.8), though the vendor recommendation explicitly names 2.0.10. The advisory is available at https://lists.apache.org/thread/04j2l6dosyboor4o2gvrzbrcrpllmh95. If immediate upgrade is not possible, a compensating control is to restrict network access to the IoTDB REST API (default port 18080) to only trusted client IP ranges using firewall or network ACLs, reducing the pool of authenticated users who can reach the vulnerable endpoint. This does not eliminate the authorization bypass but limits exposure to already-trusted principals. Note that disabling the REST v2 API entirely would break integrations relying on fastLastQuery and should be evaluated against operational impact before applying.
More in Apache Iotdb
View allUnsafe reflection in Apache IoTDB's pipe processor lets a user-supplied fully qualified Java class name be loaded and in
Authentication bypass via capture-replay in Apache IoTDB (1.0.0 through 2.0.9) lets attackers reuse stale credentials ag
Arbitrary file write in Apache IoTDB DataNode (versions 1.3.3 up to but not including 2.0.8) allows attackers who can re
Arbitrary file write in Apache IoTDB (versions 1.0.0 through 2.0.9) lets remote attackers plant files anywhere the IoTDB
Denial of service in Apache IoTDB's Thrift-based RPC service allows remote unauthenticated attackers to crash the databa
Unauthenticated denial of service in Apache IoTDB (1.0.0 through 2.0.9) allows remote attackers to crash or degrade the
Denial of service in Apache IoTDB versions 1.3.3 through 2.0.7 lets remote attackers crash the DataNode process by submi
Denial of service in Apache IoTDB versions 1.0.0 up to (but not including) 2.0.10 lets an unauthenticated network attack
Authentication bypass via sessionId spoofing in Apache IoTDB (1.3.3 through versions before 2.0.8) lets a remote, unauth
Privilege escalation in Apache IoTDB 2.0.8 through 2.0.9 allows any authenticated low-privilege user to rename their own
Path traversal in Apache IoTDB (1.0.0 before 1.3.6 and 2.0.0 before 2.0.7) allows remote attackers to read and write fil
Path traversal in Apache IoTDB (versions 1.0.0–1.3.5 and 2.0.0–2.0.5) lets remote unauthenticated attackers reference fi
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today