CVE-2026-24015: Apache IoTDB Insecure Default Configuration Vulnerability
Summary
CVE-2026-24015: Apache IoTDB has an Insecure Default Configuration Vulnerability. Affects org.apache.iotdb:iotdb-core across 2 version ranges.
>= 1.0.0, < 1.3.7
>= 2.0.0, < 2.0.7
Fixed in 1.3.7 or 2.0.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache IoTDB is an open-source time-series database designed for storing and managing time-series data efficiently. It is widely used in IoT applications due to its high performance and scalability. However, certain versions of Apache IoTDB have been found to have an insecure default configuration, which can expose users to potential security risks.
Vulnerability Detail
The vulnerability in Apache IoTDB arises from its insecure default configuration settings, which can lead to unauthorized access and manipulation of sensitive data. This issue affects versions from 1.0.0 before 1.3.7 and from 2.0.0 before 2.0.7. If exploited, attackers could gain access to the database, potentially leading to data breaches or service disruptions. The vulnerability is classified under CWE-1327, indicating a critical security flaw that needs immediate attention.
How To Fix
Latest published version: 2.0.11 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.3.71.3.7 -
>= 2.0.0, < 2.0.72.0.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually review and modify the default configuration settings of Apache IoTDB to enhance security. This includes changing default passwords, restricting access to the database, and implementing network security measures.
Conclusion
The insecure default configuration vulnerability in Apache IoTDB poses significant risks to users. It is crucial to upgrade to the latest patched versions and implement security best practices to safeguard your data and systems.
See every vulnerability recorded for org.apache.iotdb:iotdb-core →
FAQ
CVE-2026-24015 is a vulnerability in Apache IoTDB that stems from insecure default configurations, potentially allowing unauthorized access to the database.
The vulnerability affects Apache IoTDB versions from 1.0.0 before 1.3.7 and from 2.0.0 before 2.0.7.
You can use Vulert, which monitors and alerts for open-source vulnerabilities using just the pom.xml file. Visit Vulert Scanner to check your application without any signup.
The CVSS score for this vulnerability is 9.8, indicating a critical level of risk.
Upgrade to the patched versions of Apache IoTDB (1.3.7 or 2.0.7) and review your configuration settings to ensure they are secure.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.iotdb:iotdb-core.
