Apache IoTDB EUVD-2026-107162

Exploitation requires network reachability to the Apache IoTDB Thrift RPC service (the standard client/session interface, default TCP port 6667) on an instance running an affected version (2.0.0 through 2.0.10). The description names no additional feature toggle, non-default configuration, or user interaction, implying default-configuration instances are affected once the RPC port is reachable. The principal limiting factor is therefore network exposure of the RPC port: instances firewalled to trusted application tiers face substantially lower risk than those reachable from untrusted networks. Note that the exact precondition (e.g., whether any partial credential or specific session state is needed) is not detailed in the advisory text and should be verified against the Apache source fix.

No CVSS, EPSS, KEV, or POC signals are present in the input, so quantitative exploitation scoring is unavailable and must be inferred from the vulnerability class and affected component. The flaw is an authentication bypass in Apache IoTDB's Thrift RPC service - the primary client-facing interface of the database - which is intrinsically high-impact because it defeats the access-control boundary rather than merely leaking a single resource. Working against prioritization: Apache IoTDB has a comparatively niche deployment footprint, no confirmed active exploitation (not in CISA KEV), and no public exploit code identified, suggesting this is not yet a mass-exploitation target. In the absence of a vendor CVSS vector, authentication requirements and attack complexity cannot be confirmed from NVD/vendor data and are inferred only from the 'authentication bypass' class and the networked nature of Thrift RPC - verify specifics with the Apache advisory. Net: treat as a high-priority patch for any internet- or network-exposed IoTDB instance in the 2.0.0-2.0.10 range, but current evidence points to latent rather than widespread active risk.

An attacker with network reachability to an Apache IoTDB node's Thrift RPC port connects and leverages the bypass to interact with the database without presenting valid credentials, gaining the ability to read or manipulate stored time-series data. No public exploit code has been identified at time of analysis, so weaponization effort is presently unknown. The realistic exposure depends on whether the RPC port is reachable from untrusted networks.