Product by Apache Software Foundation

    Apache IoTDB

    20 known vulnerabilities in Apache IoTDB (Apache Software Foundation), 0 of them actively exploited (CISA KEV).

    Key figures

    20

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    9

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority.

    Vulnerabilities in Apache IoTDB (Apache Software Foundation)
    SeverityCVETitleCVSSPublished
    HighCVE-2020-25649

    Jackson-databind: Improper Restriction of XML External Entity Reference

    		7.5
    CriticalCVE-2020-1952

    Apache IoTDB: security vulnerability

    		9.8
    CriticalCVE-2023-46226

    Apache IoTDB: Remote Code Execution (RCE) risk via the UDF

    		9.8
    CriticalCVE-2024-24780

    Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function

    		9.8
    CriticalCVE-2026-24014

    Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write

    		9.8
    CriticalCVE-2023-24831

    Apache IoTDB grafana-connector Login Bypass Vulnerability

    		9.8
    CriticalCVE-2026-24013

    Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC

    		9.1
    CriticalCVE-2026-24713

    Apache IoTDB: JEXL Expression Injection Vulnerability

    		9.8
    CriticalCVE-2023-51656

    Apache IoTDB: Unsafe deserialize map in Sync Tool

    		9.8
    HighCVE-2023-24829

    Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench

    		8.8
    HighCVE-2022-38369

    Login check vulnerability by session Id

    		8.8
    CriticalCVE-2026-24015

    Apache IoTDB: Insecure Default Configuration Vulnerability

    		9.8
    HighCVE-2022-43766

    Apache IoTDB prior to 0.13.3 allows DoS

    		7.5
    HighCVE-2026-24012

    Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query

    		7.5
    HighCVE-2023-24830

    Apache IoTDB Workbench: apache/iotdb-web-workbench: create a user without authorization

    		7.5
    HighCVE-2022-38370

    Apache IoTDB: security vulnerability

    		7.5
    HighCVE-2025-26864

    Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication

    		7.5
    HighCVE-2025-26795

    Apache IoTDB JDBC driver: Exposure of Sensitive Information in IoTDB JDBC driver

    		7.5
    HighCVE-2025-48392

    Apache IoTDB: DoS Vulnerability

    		7.5
    MediumCVE-2025-48459

    Apache IoTDB: Deserialization of untrusted Data

    		5.3

    News

    All products by Apache Software Foundation