CVE-2026-40008
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability in Apache IoTDB allows remote code execution through unsafe reflection. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting.
Risk Assessment
An attacker can supply a malicious class name, leading to arbitrary code execution on the IoTDB server. This could result in full system compromise, data theft, or service disruption.
Recommendation
Upgrade Apache IoTDB to version 2.0.10 or later immediately, which contains the fix for this vulnerability.
Original NVD description (English source)
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.