Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-24013

Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attacker can construct requests with a forged sessionId and, without performing openSession authentication, receive valid query results. This allows authentication bypass and unauthorized reading of time-series data. This issue affects Apache IoTDB: from 1.3.3 before 2.0.8. Users are recommended to upgrade to version 2.0.8, which fixes the issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 32.6%
CVSS Severity
CVSS v3 Score 9.1
Products affected by CVE-2026-24013
  • Apache » Iotdb » Version: 1.3.3
    cpe:2.3:a:apache:iotdb:1.3.3
  • Apache » Iotdb » Version: 1.3.4
    cpe:2.3:a:apache:iotdb:1.3.4
  • Apache » Iotdb » Version: 1.3.4-1
    cpe:2.3:a:apache:iotdb:1.3.4-1
  • Apache » Iotdb » Version: 1.3.5
    cpe:2.3:a:apache:iotdb:1.3.5
  • Apache » Iotdb » Version: 1.3.7
    cpe:2.3:a:apache:iotdb:1.3.7
  • Apache » Iotdb » Version: 2.0.0
    cpe:2.3:a:apache:iotdb:2.0.0
  • Apache » Iotdb » Version: 2.0.1
    cpe:2.3:a:apache:iotdb:2.0.1
  • Apache » Iotdb » Version: 2.0.2
    cpe:2.3:a:apache:iotdb:2.0.2
  • Apache » Iotdb » Version: 2.0.2-1
    cpe:2.3:a:apache:iotdb:2.0.2-1
  • Apache » Iotdb » Version: 2.0.3
    cpe:2.3:a:apache:iotdb:2.0.3
  • Apache » Iotdb » Version: 2.0.4
    cpe:2.3:a:apache:iotdb:2.0.4
  • Apache » Iotdb » Version: 2.0.5
    cpe:2.3:a:apache:iotdb:2.0.5
  • Apache » Iotdb » Version: 2.0.7
    cpe:2.3:a:apache:iotdb:2.0.7


Products
Pricing
Contact Us

Shodan ® - All rights reserved