CVE-2026-24013
Received Received - Intake

Authentication Bypass via Spoofed SessionID in Apache IoTDB

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: Apache Software Foundation

Description
Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attacker can construct requests with a forged sessionId and, without performing openSession authentication, receive valid query results. This allows authentication bypass and unauthorized reading of time-series data. This issue affects Apache IoTDB: from 1.3.3 before 2.0.8. Users are recommended to upgrade to version 2.0.8, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-06
Last Modified
2026-07-06
Generated
2026-07-06
AI Q&A
2026-07-06
EPSS Evaluated
N/A
NVD
CVE-2026-24013
EUVD
EUVD-2026-41857

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache iotdb From 1.3.3 (inc) to 2.0.8 (exc)
apache iotdb 2.0.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Authentication Bypass by Spoofing in Apache IoTDB. Certain Thrift RPC query handlers do not strictly validate the sessionId parameter. As a result, an attacker can forge a sessionId and send requests without performing the required openSession authentication, allowing them to receive valid query results.

In simpler terms, the system mistakenly trusts fake session identifiers, letting unauthorized users access time-series data.

Impact Analysis

This vulnerability allows an attacker to bypass authentication and read sensitive time-series data without authorization. This unauthorized access can lead to data leakage, compromise of confidential information, and potential misuse of the data.

Mitigation Strategies

To mitigate this vulnerability, users are recommended to upgrade Apache IoTDB to version 2.0.8 or later, as this version contains the fix for the authentication bypass issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24013. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart