Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN746 _____________________________________________________________________ DATE : 13/07/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Apache IoTDB versions prior to 2.0.10. ===================================================================== https://lists.apache.org/thread/l38wpy7flvvfwv4rkps87l5z8gprnfy0 https://lists.apache.org/thread/zw2vkbmy5xkf5y8g237v81hrs4c6b5lq https://lists.apache.org/thread/rfpt7m9fvdrw37r3ow5omp2n914z6zqk https://lists.apache.org/thread/tr23kh6kp8drrsv8ypv1mqm4v5kyy23m https://lists.apache.org/thread/fm8cpvzbox2qqy99ztglm8wkk1nrg9ng https://lists.apache.org/thread/65hh7dh28rcxlzdzwdpt630321tr8b61 https://lists.apache.org/thread/04j2l6dosyboor4o2gvrzbrcrpllmh95 https://lists.apache.org/thread/9wml325g6bpovw0jf5ymtc3xl7fwlkrn _____________________________________________________________________ CVE-2026-28564: Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials Severity: important Affected versions: - Apache IoTDB 1.0.0 before 2.0.10 Description: Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credentials This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue. Credit: Aristore (https://github.com/aristorechina) (finder) References: https://iotdb.apache.org https://www.cve.org/CVERecord?id=CVE-2026-28564 _____________________________________________________________________ CVE-2026-40005: Apache IoTDB: Path Traversal in Pipe File Transfer Receiver Severity: important Affected versions: - Apache IoTDB 1.0.0 before 2.0.10 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process has write permissions with unsafe API. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue. Credit: Andrea Cosentino (finder) References: https://iotdb.apache.org https://www.cve.org/CVERecord?id=CVE-2026-40005 _____________________________________________________________________ CVE-2026-40006: Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver Severity: important Affected versions: - Apache IoTDB 1.0.0 before 2.0.10 Description: Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap pipe receiver accepts raw TCP connections on port 9780 with no authentication. The readLength method reads an attacker-controlled 32-bit integer from the socket and readData passes it directly to new byte[length] with no upper-bound check. An unauthenticated attacker can cause the JVM to attempt an allocation of up to 2,147,483,647 bytes per connection, exhausting heap memory and crashing or severely degrading the DataNode process. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue. Credit: bugbunny.ai (finder) References: https://iotdb.apache.org https://www.cve.org/CVERecord?id=CVE-2026-40006 _____________________________________________________________________ CVE-2026-40007: Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowError Severity: moderate Affected versions: - Apache IoTDB 1.0.0 before 2.0.10 Description: Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap receiver's readLength method calls itself recursively each time it recognises the E-language prefix in socket data, with no depth limit. An unauthenticated attacker can send a stream of repeated E-language prefixes that drives the recursion arbitrarily deep, exhausting the receiver thread's JVM stack and raising StackOverflowError. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue. Credit: bugbunny.ai (finder) References: https://iotdb.apache.org https://www.cve.org/CVERecord?id=CVE-2026-40007 _____________________________________________________________________ CVE-2026-40008: Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC Severity: important Affected versions: - Apache IoTDB 1.0.0 before 2.0.10 Description: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue. Credit: Andrea Cosentino (finder) References: https://iotdb.apache.org https://www.cve.org/CVERecord?id=CVE-2026-40008 _____________________________________________________________________ CVE-2026-40009: Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor Severity: important Affected versions: - Apache IoTDB 2.0.8 before 2.0.10 Description: Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor. This issue affects Apache IoTDB: from 2.0.8 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue. Credit: bugbunny.ai (finder) References: https://iotdb.apache.org https://www.cve.org/CVERecord?id=CVE-2026-40009 _____________________________________________________________________ CVE-2026-40452: Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users Severity: moderate Affected versions: - Apache IoTDB 1.3.5 before 1.3.8 - Apache IoTDB 2.0.5 before 2.0.10 Description: Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users. This issue affects Apache IoTDB: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue. Credit: bugbunny.ai (finder) References: https://iotdb.apache.org https://www.cve.org/CVERecord?id=CVE-2026-40452 _____________________________________________________________________ CVE-2026-40454: Apache IoTDB C++ client: Out-of-bounds reads in C++ client TsBlock deserializer crash client process on malformed server data Severity: moderate Affected versions: - Apache IoTDB C++ client (client-cpp) 1.3.5 before 1.3.8 - Apache IoTDB C++ client (client-cpp) 2.0.5 before 2.0.10 Description: Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bounds reads in IoTDB C++ client TsBlock deserializer crash client process on malformed server data. This issue affects Apache IoTDB C++ client: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue. Credit: bugbunny.ai (finder) References: https://iotdb.apache.org https://www.cve.org/CVERecord?id=CVE-2026-40454 ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================