Executive brief
Apache IoTDB, a database designed for managing massive amounts of Internet of Things (IoT) data, contains a security flaw in its REST API. This vulnerability allows an authenticated user to bypass authorization checks and view the most recent data values (last-value data) that they should not have permission to access. This could lead to the unauthorized disclosure of sensitive operational or sensor data.
Technical details
An authorization bypass vulnerability exists in Apache IoTDB within the /rest/v2/fastLastQuery endpoint. The flaw is rooted in improper access control (CWE-284) and incorrect authorization (CWE-863) logic. An attacker with valid authentication credentials can exploit this endpoint to retrieve 'last-value' data from time-series records they are not authorized to view. The issue affects versions 1.3.5 through 1.3.7 and 2.0.5 through 2.0.9. Users are advised to upgrade to version 2.0.10 to remediate the vulnerability.
Affected products
- Apache IoTDB 1.3.5 to 1.3.7, 2.0.5 to 2.0.9
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory