CVE-2026-28564

A vulnerability in Apache IoTDB allows remote code execution through unsafe reflection. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting.

A Path Traversal vulnerability was found in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process has write permissions using an unsafe API.

The internal RPC interface of Apache IoTDB DataNode for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file write with the permissions of the IoTDB process.

An authentication bypass vulnerability via spoofing has been found in Apache IoTDB. Thrift RPC query handlers do not properly validate the sessionId parameter, allowing an attacker to forge requests and receive query results without authentication. Affected versions are from 1.3.3 before 2.0.8.

A path traversal vulnerability has been discovered in Apache IoTDB, allowing access to files outside the restricted directory. The issue affects versions from 1.0.0 to 1.3.5 and from 2.0.0 to 2.0.6.

A Path Traversal vulnerability has been discovered in Apache IoTDB, allowing bypass of file path restrictions. The issue affects versions from 2.0.0 before 2.0.6 and from 1.0.0 before 1.3.6.

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Affects versions before 1.3.8 and from 2.0.0 before 2.0.9. Users are recommended to upgrade to version 2.0.10.

A vulnerability in Apache IoTDB allows unauthorized but authenticated users to access last-value data via the /rest/v2/fastLastQuery endpoint. The issue is caused by incorrect authorization and improper access control.

An improper privilege management and access control vulnerability exists in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor.

An uncontrolled recursion and resource consumption vulnerability exists in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the AirGap receiver's readLength method recursively calls itself without depth limit upon recognizing the E-language prefix in socket data. An unauthenticated attacker can send a stream of repeated E-language prefixes, causing a JVM stack overflow and StackOverflowError.