Executive brief
Apache IoTDB, a database designed for managing large amounts of time-series data, contains a security flaw in its REST interface. The system incorrectly accepts outdated login credentials that should have expired, which could allow an unauthorized person to reuse old session information to gain access to the database. This could lead to unauthorized data access or modification, potentially compromising sensitive industrial or operational data.
Technical details
Apache IoTDB versions 1.0.0 through 2.0.9 are vulnerable to authentication bypass and session management issues. The REST Basic Authentication mechanism fails to properly invalidate cached credentials, leading to insufficient session expiration (CWE-613). This flaw allows for authentication bypass via capture-replay (CWE-294), where an attacker can reuse intercepted or stale credentials to gain unauthorized access to the REST API. The vulnerability is resolved in version 2.0.10 by ensuring credentials are properly validated and expired.
Affected products
- Apache IoTDB 1.0.0 to 2.0.9
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory
- 2026-07-10: patched: Fixed in version 2.0.10