CVE-2026-24713

The vulnerability results from insufficient validation of user-supplied input data (CWE-20) combined with the possibility of expression or instruction injection (CWE-917). An attacker can submit a specially crafted request to the Apache IoTDB server without requiring authentication, login, or victim-side interaction. The network vector (AV:N) and lack of prerequisites (PR:N, AC:L, UI:N) make this vulnerability particularly easy to exploit.

Successful exploitation of this vulnerability can lead to complete compromise of system confidentiality, integrity, and availability — attackers can gain unauthorized access to data, modify it, or cause service unavailability.

Apache IoTDB must be immediately updated to version 1.3.7 (for 1.x branch) or 2.0.7 (for 2.x branch), which contain a patch eliminating the vulnerability. Detailed information is available in the vendor references: https://lists.apache.org/thread/vopgv6y2ccw403b0zv7rvojjrh7x1j5p

Apache IoTDB versions from 1.0.0 to 1.3.6 (before 1.3.7) and from 2.0.0 to 2.0.6 (before 2.0.7).