CVE-2026-24014
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The internal RPC interface of Apache IoTDB DataNode for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file write with the permissions of the IoTDB process.
Risk Assessment
The risk is that an attacker can remotely write arbitrary files, potentially leading to full compromise of the IoTDB server, execution of malicious code, or modification of critical data.
Recommendation
It is recommended to immediately upgrade Apache IoTDB to version 2.0.8, which fixes this vulnerability. Also ensure that the internal DataNode RPC port is not exposed to untrusted networks.
Other vulnerabilities in Apache IoTDB
See all- CVE-2026-40008Critical
A vulnerability in Apache IoTDB allows remote code execution through unsafe reflection. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting.
- CVE-2026-40005Critical
A Path Traversal vulnerability was found in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process has write permissions using an unsafe API.
- CVE-2026-28564Critical
In Apache IoTDB, a vulnerability was found due to insufficient session expiration and authentication bypass via capture-replay attack. REST Basic Authentication accepts stale cached credentials.
- CVE-2026-24013Critical
An authentication bypass vulnerability via spoofing has been found in Apache IoTDB. Thrift RPC query handlers do not properly validate the sessionId parameter, allowing an attacker to forge requests and receive query results without authentication. Affected versions are from 1.3.3 before 2.0.8.
- CVE-2025-64152Critical
A path traversal vulnerability has been discovered in Apache IoTDB, allowing access to files outside the restricted directory. The issue affects versions from 1.0.0 to 1.3.5 and from 2.0.0 to 2.0.6.
- CVE-2025-55017Critical
A Path Traversal vulnerability has been discovered in Apache IoTDB, allowing bypass of file path restrictions. The issue affects versions from 2.0.0 before 2.0.6 and from 1.0.0 before 1.3.6.
- CVE-2026-59562Low risk· EPSS 20%
A missing authentication for critical function vulnerability exists in Apache IoTDB versions from 2.0.0 before 2.0.11. The flaw may allow unauthorized access to important system functionality.
- CVE-2026-59229Low risk· EPSS 16%
The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges (such as USE_PIPE or MAINTAIN) but without WRITE_DATA or DELETE_DATA permissions can send crafted PipeData messages to execute operations as root, bypassing IoTDB's permission model.
- CVE-2026-58663Low risk· EPSS 19%
An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service in versions from 2.0.0 before 2.0.11. It may allow an attacker to gain access without valid credentials.
- CVE-2026-44630High
Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Affects versions before 1.3.8 and from 2.0.0 before 2.0.9. Users are recommended to upgrade to version 2.0.10.
Original NVD description (English source)
Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file write with the permissions of the IoTDB process. This issue affects Apache IoTDB: from 1.3.3 before 2.0.8. Users are recommended to upgrade to version 2.0.8, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS