Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

apache-iotdb

13 known vulnerabilities (6 critical, 5 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
2.0.11 (Sep 14, 2026): affected by CVE-2023-30771
Newest unaffected release
Every release is affected by at least one advisory
Advisories
13 · 6 critical, 5 high, 1 medium
Weekly downloads
978
Dependents
10
Releases
46 since 0.9.0 (Dec 8, 2019)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 13

  • CVE-2026-24013Critical 9.1

    Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC

    Affected: from 1.3.3, fixed in 2.0.8.

    Fixed in 2.0.8 (released Apr 14, 2026, 83 days before disclosure).

    The latest release, 2.0.11, is not affected.

  • Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query

    Affected: from 1.3.3, fixed in 2.0.8.

    Fixed in 2.0.8 (released Apr 14, 2026, 83 days before disclosure).

    The latest release, 2.0.11, is not affected.

  • CVE-2026-24014Critical 9.8

    Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write

    Affected: from 1.3.3, fixed in 2.0.8.

    Fixed in 2.0.8 (released Apr 14, 2026, 83 days before disclosure).

    The latest release, 2.0.11, is not affected.

  • CVE-2025-48459Medium 5.3

    Apache IoTDB: Deserialization of untrusted Data

    Affected: from 1.0.0, fixed in 2.0.5.

    Fixed in 2.0.5 (released Aug 22, 2025, 33 days before disclosure).

    The latest release, 2.0.11, is not affected.

  • Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication

    Affected: from 0.10.0, fixed in 1.3.4; from 2.0.1b0, fixed in 2.0.2.

    Fixed in 1.3.4 (released Apr 17, 2025, 27 days before disclosure) and 2.0.2 (released Apr 17, 2025, 27 days before disclosure).

    The latest release, 2.0.11, is not affected.

  • CVE-2024-24780Critical 9.8

    Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function

    Affected: from 1.0.0, fixed in 1.3.4.

    Fixed in 1.3.4 (released Apr 17, 2025, 27 days before disclosure).

    The latest release, 2.0.11, is not affected.

  • CVE-2023-46226Critical 9.8

    Apache IoTDB: Remote Code Execution (RCE) risk via the UDF

    Affected: from 1.0.0, fixed in 1.3.0.

    Fixed in 1.3.0 (released Jan 2, 2024, 13 days before disclosure).

    The latest release, 2.0.11, is not affected.

  • CVE-2023-30771Critical 9.8

    Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench

    Affected: all versions.

    No fix released. The latest release, 2.0.11, is still affected.

  • CVE-2023-24831Critical 9.8

    Apache IoTDB grafana-connector Login Bypass Vulnerability

    Affected: from 0.13.0, fixed in 0.13.5.

    Fixed in 0.13.5 (released Mar 23, 2023, 25 days before disclosure).

    The latest release, 2.0.11, is not affected.

  • Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench

    Affected: from 0.13.0, fixed in 0.13.3.

    Fixed in 0.13.3 (released Dec 19, 2022, 43 days before disclosure).

    The latest release, 2.0.11, is not affected.

  • Apache IoTDB Workbench: apache/iotdb-web-workbench: create a user without authorization

    Affected: from 0.13.0, fixed in 0.13.3.

    Fixed in 0.13.3 (released Dec 19, 2022, 42 days before disclosure).

    The latest release, 2.0.11, is not affected.

  • Apache IoTDB prior to 0.13.3 allows DoS

    Affected: from 0.12.2, fixed in 0.13.3.

    Fixed in 0.13.3 (released Dec 19, 2022, 54 days after disclosure).

    The latest release, 2.0.11, is not affected.

  • Login check vulnerability by session Id

    Affected: fixed in 0.13.1.

    Fixed in 0.13.1 (released Aug 9, 2022, 27 days before disclosure).

    The latest release, 2.0.11, is not affected.