Description
Authentication Bypass by Spoofing vulnerability in Apache IoTDB.
Certain Thrift RPC query handlers lack strict validation of the sessionId
parameter. An attacker can construct requests with a forged sessionId and,
without performing openSession authentication, receive valid query results.
This allows authentication bypass and unauthorized reading of time-series
data.
This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.
Users are recommended to upgrade to version 2.0.8, which fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache IoTDB | 1.3.3 – < 2.0.8 | 2.0.8 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | apache-iotdb | >= 1.3.3, < 2.0.8 | 2.0.8 | PYSEC-2026-2080 |
References
- https://lists.apache.org/thread/6pwkgnqhbm56mvn309f87snm84s0b75y vendor-advisory