CVE-2026-24013: Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC
Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attacker can construct requests with a forged sessionId and, without performing openSession authentication, receive valid query results. This allows authentication bypass and unauthorized reading of time-series data.
This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.
Users are recommended to upgrade to version 2.0.8, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache IoTDBto a version that resolves this vulnerability.Fixed in 2.0.8 - Compensating control
As a temporary mitigation until the affected Apache IoTDB versions are upgraded, restrict network access to the Thrift RPC service so only authorized clients can reach it.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24013?
CVE-2026-24013 has a risk rating of 70, indicating a moderate severity level.
How do I fix CVE-2026-24013?
To mitigate CVE-2026-24013, ensure that strict validation of the sessionId parameter in Thrift RPC query handlers is implemented.
What types of systems are affected by CVE-2026-24013?
CVE-2026-24013 affects systems running Apache IoTDB that use Thrift RPC for communication.
What can an attacker do with CVE-2026-24013?
An attacker can exploit CVE-2026-24013 to bypass authentication and directly access valid query results by forging the sessionId.
When was CVE-2026-24013 published?
CVE-2026-24013 was published on July 6, 2026.