Apache IoTDB EUVD-2026-107166

Exploitation requires network reachability to an Apache IoTDB service running an affected version (2.0.0 through 2.0.10); the advisory describes a missing authentication check on a critical function, meaning no valid credentials are needed to invoke it. The limiting factors are that the specific affected function and its default exposure are not detailed in the advisory, the deployment must be running a vulnerable pre-2.0.11 version, and the IoTDB endpoint must be reachable by the attacker (e.g., not isolated behind network controls). No user interaction appears to be required based on the CWE-306 classification.

This is a CWE-306 (Missing Authentication for Critical Function) flaw in Apache IoTDB, which by its nature means a security-critical operation can be reached without authentication - a serious class of weakness. However, the available signals are sparse: no CVSS score or vector was provided (CVSS: N/A), there is no EPSS exploitation-probability data, the CVE is NOT listed in CISA KEV, and no public POC was identified. The only authoritative source is the Apache project's own advisory (reported by apache). Because no CVSS vector is supplied, attack vector, complexity, and privilege requirements cannot be confirmed from the input and must be inferred from the CWE and product architecture: IoTDB is a network-facing time-series database, so the missing-authentication weakness most plausibly exposes a network-reachable function to unauthenticated clients, but this is INFERRED, not confirmed. No SSVC decision data was provided. Net assessment: the vulnerability class is high-impact and should be patched promptly (fix is available in 2.0.11), but there is currently no evidence of active or at-scale exploitation - treat as a prioritized patch rather than an emergency, pending a vendor CVSS vector to confirm the true attack surface.

An attacker with network reachability to an Apache IoTDB instance (versions 2.0.0 up to 2.0.11) invokes a critical function that fails to enforce authentication, performing privileged operations such as reading or manipulating stored time-series data without valid credentials. No public exploit code was identified at time of analysis, and the exact exposed function is not detailed in the advisory, so a real-world attack would require probing the service interface to locate the unauthenticated entry point.