# CVE-2026-24013: Apache IoTDB authentication bypass in Thrift RPC query handlers

Source: https://junglewise.ai/threats/cve-2026-24013-apache-iotdb-authentication-bypass-in-thrift-rpc-query-handlers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-24013 · Severity: low · CVSS 3.1 · Published 2026-07-06

Apache IoTDB, a database designed for managing large amounts of time-series data, contains a security flaw that allows unauthorized users to bypass login requirements. By forging a session identifier, an attacker can trick the system into providing access to sensitive data without a valid password. This could lead to the unauthorized disclosure of proprietary sensor data or operational metrics stored within the database.

Technologies: [Apache Software Foundation IoTDB](https://junglewise.ai/threats/technologies/iotdb), [apache-iotdb (PyPI)](https://junglewise.ai/threats/technologies/apache-iotdb). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-24013 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24013 being exploited in the wild.

**How severe is CVE-2026-24013?** Low severity, with a CVSS score of 3.1, published 6 July 2026.

**Which products and versions are affected?** Apache Software Foundation IoTDB 1.3.3 to 2.0.7; apache-iotdb (PyPI) ECOSYSTEM:introduced=1.3.3,fixed=2.0.8.

**Is there a fix for CVE-2026-24013?** Yes. apache-iotdb (PyPI): upgrade to 2.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-24013 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-24013?** Check whether you run Apache Software Foundation IoTDB or apache-iotdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- apache-iotdb (PyPI): upgrade to 2.0.8 or later

  ```sh
  pip install "apache-iotdb>=2.0.8"
  ```


## Technical details

An authentication bypass vulnerability exists in Apache IoTDB due to insufficient validation of the sessionId parameter within certain Thrift RPC query handlers. The root cause is a failure to strictly verify that a provided sessionId has undergone the standard openSession authentication process. A remote, unauthenticated attacker can exploit this by constructing malicious RPC requests with a forged sessionId to retrieve valid query results. This allows for unauthorized reading of time-series data. The issue is fixed in version 2.0.8.

## Affected products

- Apache IoTDB 1.3.3 to 2.0.7

## Identifiers

- CVE-2026-24013
- PYSEC-2026-2080

## Timeline

- 2026-07-06: advisory: Initial disclosure of CVE-2026-24013
- 2026-07-06: patched: Version 2.0.8 released to address the vulnerability

## References

- [https://lists.apache.org/thread/6pwkgnqhbm56mvn309f87snm84s0b75y](https://lists.apache.org/thread/6pwkgnqhbm56mvn309f87snm84s0b75y)

## Related threats

- [Apache IoTDB authorization bypass in fastLastQuery REST endpoint](https://junglewise.ai/threats/cve-2026-40452-apache-iotdb-authorization-bypass-in-fastlastquery-rest-endpoint)
- [Apache IoTDB privilege escalation via account renaming](https://junglewise.ai/threats/cve-2026-40009-apache-iotdb-privilege-escalation-via-account-renaming)
- [Apache IoTDB unsafe reflection in pipe processor](https://junglewise.ai/threats/cve-2026-40008-apache-iotdb-unsafe-reflection-in-pipe-processor)
- [Apache IoTDB uncontrolled recursion in AirGap receiver](https://junglewise.ai/threats/cve-2026-40007-apache-iotdb-uncontrolled-recursion-in-airgap-receiver)
- [Apache IoTDB resource exhaustion in AirGap pipe receiver](https://junglewise.ai/threats/cve-2026-40006-apache-iotdb-resource-exhaustion-in-airgap-pipe-receiver)