CVE-2026-40008 Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC

Critical 9.8 Published 10 Jul 2026 Updated 10 Jul 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-40008?

CVE-2026-40008 is a critical vulnerability in Apache IoTDB, published on 10 Jul 2026.

Official description

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting.

This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.

Users are recommended to upgrade to version 2.0.10, which fixes the issue.

Weakness: CWE-470

Which versions are affected by CVE-2026-40008?

How do I fix CVE-2026-40008?

No fix has been published for CVE-2026-40008 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-40008 being exploited?

There is no known exploitation of CVE-2026-40008 in the wild and no public exploit code.

Sources

Also known as GHSA-v4p4-86j5-2f8q.