CVE-2026-28564
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In Apache IoTDB, a vulnerability was found due to insufficient session expiration and authentication bypass via capture-replay attack. REST Basic Authentication accepts stale cached credentials.
Risk Assessment
An attacker can capture valid credentials and reuse them to gain unauthorized access to the system, potentially leading to data confidentiality and integrity breaches.
Recommendation
Immediately upgrade Apache IoTDB to version 2.0.10, which includes a fix for this vulnerability.
Original NVD description (English source)
Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credentials This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.