CVE-2026-40008: Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting.
This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache IoTDBto a version that resolves this vulnerability.Fixed in 2.0.10
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40008?
CVE-2026-40008 has a critical severity rating of 9.8 according to the CVSS v3.1 metrics.
How do I fix CVE-2026-40008?
To fix CVE-2026-40008, ensure that input validation is implemented to prevent arbitrary class instantiation via the pipe transfer RPC.
What systems are affected by CVE-2026-40008?
CVE-2026-40008 affects Apache IoTDB instances that utilize the pipe processor for processing input.
What type of vulnerability is CVE-2026-40008?
CVE-2026-40008 is categorized as an 'Unsafe Reflection' vulnerability which allows arbitrary class instantiation.
What are the potential risks of CVE-2026-40008?
The potential risks of CVE-2026-40008 include remote code execution due to uncontrolled inputs leading to malicious class instantiation.