PT-2026-55879 · Apache · Apache Iotdb
Yan Nan
·
Published
2026-07-06
·
Updated
2026-07-06
·
CVE-2026-24013
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Apache IoTDB versions 1.3.3 through 2.0.7
Description
An authentication bypass issue exists due to insufficient validation of the
sessionId parameter within certain Thrift RPC query handlers. An attacker can forge the sessionId to bypass the openSession authentication process, allowing unauthorized access to and reading of time-series data.Recommendations
Upgrade to version 2.0.8.
Authentication Bypass by Spoofing
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Iotdb