CVE-2026-24013 Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC

Critical 9.1 Published 6 Jul 2026 Updated 6 Jul 2026

Attackers can bypass authentication in Apache IoTDB by forging session IDs in Thrift RPC requests, allowing unauthorized access to time-series data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-24013?

CVE-2026-24013 is a critical authentication bypass vulnerability in Apache IoTDB, published on 6 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attacker can construct requests with a forged sessionId and, without performing openSession authentication, receive valid query results. This allows authentication bypass and unauthorized reading of time-series data.

This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.

Users are recommended to upgrade to version 2.0.8, which fixes the issue.

Weakness: CWE-290

Which versions are affected by CVE-2026-24013?

1 open source package ship an affected version, including apache-iotdb. It affects 1 product.

Package	Affected	Fixed in
`apache-iotdb` PyPI	From `1.3.3`	`2.0.8`

Products include Apache Iotdb.

How do I fix CVE-2026-24013?

Upgrade apache-iotdb to 2.0.8 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-24013 being exploited?

There is no known exploitation of CVE-2026-24013 in the wild and no public exploit code.

Sources

Also known as GHSA-qx5v-jm63-wqfj, PYSEC-2026-2080.