https://seclists.org/oss-sec/2026/q3/115: CVE-2026-40008: Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC
Published Jul 10, 2026
·Updated
Affected Software
1 affected component
Apache IoTDB>1.0.0<2.0.10
Frequently Asked Questions
1
What is the severity of CVE-2026-40008?
The severity of CVE-2026-40008 is classified as important.
2
Which versions of Apache IoTDB are affected by CVE-2026-40008?
Apache IoTDB versions 1.0.0 before 2.0.10 are affected by CVE-2026-40008.
3
What type of vulnerability is CVE-2026-40008?
CVE-2026-40008 is a 'Use of Externally-Controlled Input to Select Classes or Code' vulnerability.
4
How does CVE-2026-40008 allow for arbitrary class instantiation?
CVE-2026-40008 allows for arbitrary class instantiation through the pipe processor reading and instantiating a fully qualified Java class name via Class.forName.
5
How can I mitigate CVE-2026-40008 in my application?
To mitigate CVE-2026-40008, upgrade to Apache IoTDB version 2.0.10 or later.