CVE-2026-24015 Apache IoTDB: Insecure Default Configuration Vulnerability
Apache IoTDB contains an insecure default configuration that may allow attackers to bypass security controls, requiring an upgrade to secure versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-24015?
CVE-2026-24015 is a critical vulnerability in Apache IoTDB, published on 9 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in Apache IoTDB.
This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.
Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.
Weakness: CWE-1327
Which versions are affected by CVE-2026-24015?
4 open source packages ship an affected version, including org.apache.iotdb:iotdb-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.iotdb:iotdb-core Maven | From 1.0.0 | 1.3.7 |
org.apache.iotdb:iotdb-core Maven | From 1.0.0 | 1.3.7 |
org.apache.iotdb:iotdb-core Maven | From 2.0.0 | 2.0.7 |
org.apache.iotdb:iotdb-core Maven | From 2.0.0 | 2.0.7 |
Products include Apache Iotdb.
How do I fix CVE-2026-24015?
Upgrade org.apache.iotdb:iotdb-core to a fixed version for your release line: 1.3.7 or 2.0.7.
Is CVE-2026-24015 being exploited?
There is no known exploitation of CVE-2026-24015 in the wild and no public exploit code.
Other vulnerabilities in Apache IoTDB
- CVE-2026-24014 Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write
- CVE-2026-24713 Apache IoTDB: JEXL Expression Injection Vulnerability
- CVE-2024-24780 Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function
- CVE-2023-46226 Apache IoTDB: Remote Code Execution (RCE) risk via the UDF
- CVE-2023-51656 Apache IoTDB: Unsafe deserialize map in Sync Tool
Sources
Also known as GHSA-74cf-pgh9-m5q2.