Is CVE-2026-28564 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28564 being exploited in the wild.

How severe is CVE-2026-28564?

Informational severity, published 10 July 2026.

Which products and versions are affected?

Apache Software Foundation IoTDB 1.0.0 to 2.0.9.

Is there a fix for CVE-2026-28564?

A patch was published on 2026-07-10: Fixed in version 2.0.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28564 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-28564?

Check whether you run Apache Software Foundation IoTDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28564: Apache IoTDB authentication bypass in REST Basic Authentication

CVE-2026-28564 · Severity: info · Published 2026-07-10

Apache IoTDB, a database designed for managing large amounts of time-series data, contains a security flaw in its REST interface. The system incorrectly accepts outdated login credentials that should have expired, which could allow an unauthorized person to reuse old session information to gain access to the database. This could lead to unauthorized data access or modification, potentially compromising sensitive industrial or operational data.

Technologies: Apache Software Foundation IoTDB. Vendors: Apache Software Foundation.

Quick answers

Is CVE-2026-28564 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28564 being exploited in the wild.
How severe is CVE-2026-28564?: Informational severity, published 10 July 2026.
Which products and versions are affected?: Apache Software Foundation IoTDB 1.0.0 to 2.0.9.
Is there a fix for CVE-2026-28564?: A patch was published on 2026-07-10: Fixed in version 2.0.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28564 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-28564?: Check whether you run Apache Software Foundation IoTDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Apache IoTDB versions 1.0.0 through 2.0.9 are vulnerable to authentication bypass and session management issues. The REST Basic Authentication mechanism fails to properly invalidate cached credentials, leading to insufficient session expiration (CWE-613). This flaw allows for authentication bypass via capture-replay (CWE-294), where an attacker can reuse intercepted or stale credentials to gain unauthorized access to the REST API. The vulnerability is resolved in version 2.0.10 by ensuring credentials are properly validated and expired.

Affected products

Apache IoTDB 1.0.0 to 2.0.9

Timeline

2026-07-10: disclosed
2026-07-10: advisory
2026-07-10: patched: Fixed in version 2.0.10

References

https://lists.apache.org/thread/l38wpy7flvvfwv4rkps87l5z8gprnfy0

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.