Executive brief
Apache IoTDB, a database designed for managing large amounts of time-series data, contains a security flaw that allows regular users to gain administrative control. By renaming their account to a specific internal system name, an authorized user can bypass security restrictions and access all data stored in the system. This could lead to unauthorized data modification or the exposure of sensitive industrial information.
Technical details
A privilege escalation vulnerability exists in Apache IoTDB due to improper privilege management and access control (CWE-269, CWE-284). The flaw allows an authenticated user to escalate their privileges to full tree-path access by renaming their username to '__internal_auditor'. This suggests a logic error where the system grants elevated permissions based on a hardcoded or reserved string without verifying the actual identity or original authorization level of the user. The vulnerability affects versions 2.0.8 through 2.0.9 and is resolved in version 2.0.10.
Affected products
- Apache IoTDB 2.0.8 to 2.0.10
Timeline
- 2026-07-10: advisory: Initial disclosure by Apache Software Foundation
- 2026-07-10: disclosed