Vulnerability PYSEC-2026-2080
Critical
CRITICAL RISK
CVSS Score: 9.1
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
4 months ago
July 06, 2026 at 09:16 AM UTC
No summary available
1.3.3 - 2.0.6
1.3.3 - 2.0.6
Details
Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attacker can construct requests with a forged sessionId and, without performing openSession authentication, receive valid query results. This allows authentication bypass and unauthorized reading of time-series data.
This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.
Users are recommended to upgrade to version 2.0.8, which fixes the issue.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
4 months ago
No summary available
1.3.3 - 2.0.6 PYSEC-2026-2079
1.3.3 - 2.0.6 PYSEC-2026-2079
Critical
4 months ago
No summary available
1.3.3 - 2.0.6 PYSEC-2026-2081
1.3.3 - 2.0.6 PYSEC-2026-2081
Medium Risk
1 year ago
Apache IoTDB: Deserialization of untrusted Data
1.0.0 - 2.0.4 GHSA-776q-jw43-fhjx
1.0.0 - 2.0.4 GHSA-776q-jw43-fhjx
Medium Risk
1 year ago
No summary available
1.0.0 - 2.0.4 PYSEC-2025-88
1.0.0 - 2.0.4 PYSEC-2025-88
Medium Risk
1 year ago
Apache IoTDB Discloses Sensitive Information via Log Files
0.10.0 - 1.3.3 and 2.0.1b0 GHSA-5fc3-pqf2-57cx
0.10.0 - 1.3.3 and 2.0.1b0 GHSA-5fc3-pqf2-57cx
Impacted packages
Timeline
Published
4 months ago
July 06, 2026 at 09:16 AM UTC
Fixed (2.0.8)
6 months ago
April 14, 2026 at 01:52 AM UTC
Last Modified
3 months ago
July 08, 2026 at 11:30 AM UTC