CVE-2026-40452: Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users
Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users.
This issue affects Apache IoTDB: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache IoTDBto a version that resolves this vulnerability.Fixed in 2.0.10Patch CVE-2026-40452
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40452?
CVE-2026-40452 has a high severity rating of 7.5 based on the CVSS 3.1 scoring system.
What type of vulnerability is CVE-2026-40452?
CVE-2026-40452 is categorized as an Incorrect Authorization and Improper Access Control vulnerability.
Which versions of Apache IoTDB are affected by CVE-2026-40452?
CVE-2026-40452 affects Apache IoTDB versions from 1.3.5 to before 1.3.8 and from 2.0.5 to before 2.0.10.
How do I fix CVE-2026-40452?
To mitigate CVE-2026-40452, it is recommended to update Apache IoTDB to version 1.3.8 or 2.0.10 or later.
What data is exposed due to CVE-2026-40452?
CVE-2026-40452 exposes last-value data to unauthorized authenticated users via the /rest/v2/fastLastQuery endpoint.