Executive brief
Apache IoTDB, a database designed for managing large amounts of sensor and device data, contains a security flaw in its data processing component. An attacker could potentially force the system to execute unauthorized code by providing a malicious class name for the system to process. This could lead to a complete takeover of the database server, resulting in data theft or service disruption.
Technical details
An 'Unsafe Reflection' vulnerability (CWE-470) exists in the Apache IoTDB pipe processor. The component accepts a fully qualified Java class name from an external source and instantiates it using Class.forName().newInstance() without performing any validation or maintaining an allowlist of permitted classes. An attacker with the ability to provide input to the pipe processor can trigger the instantiation of arbitrary classes available on the application's classpath, potentially leading to remote code execution (RCE). The vulnerability is addressed in version 2.0.10.
Affected products
- Apache IoTDB 1.0.0 to 2.0.9
Timeline
- 2026-07-10: advisory: Vulnerability disclosed by Apache Software Foundation
- 2026-07-10: disclosed