Is CVE-2026-24013 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24013 being exploited in the wild.

How severe is CVE-2026-24013?

Low severity, with a CVSS score of 3.1, published 6 July 2026.

Which products and versions are affected?

Apache Software Foundation IoTDB 1.3.3 to 2.0.7; apache-iotdb (PyPI) ECOSYSTEM:introduced=1.3.3,fixed=2.0.8.

Is there a fix for CVE-2026-24013?

Yes. apache-iotdb (PyPI): upgrade to 2.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-24013 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-24013?

Check whether you run Apache Software Foundation IoTDB or apache-iotdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24013: Apache IoTDB authentication bypass in Thrift RPC query handlers

CVE-2026-24013 · Severity: low · CVSS 3.1 · Published 2026-07-06

Apache IoTDB, a database designed for managing large amounts of time-series data, contains a security flaw that allows unauthorized users to bypass login requirements. By forging a session identifier, an attacker can trick the system into providing access to sensitive data without a valid password. This could lead to the unauthorized disclosure of proprietary sensor data or operational metrics stored within the database.

Technologies: Apache Software Foundation IoTDB, apache-iotdb (PyPI). Vendors: Apache Software Foundation, PyPI.

Quick answers

Is CVE-2026-24013 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24013 being exploited in the wild.
How severe is CVE-2026-24013?: Low severity, with a CVSS score of 3.1, published 6 July 2026.
Which products and versions are affected?: Apache Software Foundation IoTDB 1.3.3 to 2.0.7; apache-iotdb (PyPI) ECOSYSTEM:introduced=1.3.3,fixed=2.0.8.
Is there a fix for CVE-2026-24013?: Yes. apache-iotdb (PyPI): upgrade to 2.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24013 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-24013?: Check whether you run Apache Software Foundation IoTDB or apache-iotdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

apache-iotdb (PyPI): upgrade to 2.0.8 or later
```
pip install "apache-iotdb>=2.0.8"
```

Technical details

An authentication bypass vulnerability exists in Apache IoTDB due to insufficient validation of the sessionId parameter within certain Thrift RPC query handlers. The root cause is a failure to strictly verify that a provided sessionId has undergone the standard openSession authentication process. A remote, unauthenticated attacker can exploit this by constructing malicious RPC requests with a forged sessionId to retrieve valid query results. This allows for unauthorized reading of time-series data. The issue is fixed in version 2.0.8.

Affected products

Apache IoTDB 1.3.3 to 2.0.7

Identifiers

CVE-2026-24013
PYSEC-2026-2080

Timeline

2026-07-06: advisory: Initial disclosure of CVE-2026-24013
2026-07-06: patched: Version 2.0.8 released to address the vulnerability

References

https://lists.apache.org/thread/6pwkgnqhbm56mvn309f87snm84s0b75y

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.