# apache-iotdb (PyPI) vulnerabilities 13 known vulnerabilities (6 critical, 5 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.0.11 (Sep 14, 2026): affected by CVE-2023-30771 - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 978 - Dependents: 10 - Releases: 46 since 0.9.0 (Dec 8, 2019) - Registry: https://pypi.org/project/apache-iotdb/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-24013: 1.3.3 to 2.0.6 (2.0.8 is outside it) - CVE-2026-24012: 1.3.3 to 2.0.6 (2.0.8 is outside it) - CVE-2026-24014: 1.3.3 to 2.0.6 (2.0.8 is outside it) - CVE-2025-48459: 1.0.0 to 2.0.4 (2.0.5 is outside it) - CVE-2025-26864: 0.10.0 to 1.3.3 (1.3.4 is outside it); 2.0.1b0 (2.0.2 is outside it) - CVE-2024-24780: 1.0.0 to 1.3.3 (1.3.4 is outside it) - CVE-2023-46226: 1.0.0 to 1.2.1 (1.3.0 is outside it) - CVE-2023-30771: 0.9.0 to 2.0.11 (through the newest release) - CVE-2023-24831: 0.13.0 to 0.13.3 (0.13.5 is outside it) - CVE-2023-24829: 0.13.0 to 0.13.2 (0.13.3 is outside it) - CVE-2023-24830: 0.13.0 to 0.13.2 (0.13.3 is outside it) - CVE-2022-43766: 0.12.2 to 0.13.2 (0.13.3 is outside it) - CVE-2022-38369: 0.9.0 to 0.13.0.post1 (0.13.1 is outside it) ## Advisories (13) ### [CVE-2026-24013](https://cve.now/CVE-2026-24013): Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC - Severity: Critical 9.1 - Published: Jul 6, 2026 - Affected: from 1.3.3, fixed in 2.0.8. - Fixed in 2.0.8 (released Apr 14, 2026, 83 days before disclosure). - The latest release, 2.0.11, is not affected. ### [CVE-2026-24012](https://cve.now/CVE-2026-24012): Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query - Severity: High 7.5 - Published: Jul 6, 2026 - Affected: from 1.3.3, fixed in 2.0.8. - Fixed in 2.0.8 (released Apr 14, 2026, 83 days before disclosure). - The latest release, 2.0.11, is not affected. ### [CVE-2026-24014](https://cve.now/CVE-2026-24014): Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write - Severity: Critical 9.8 - Published: Jul 6, 2026 - Affected: from 1.3.3, fixed in 2.0.8. - Fixed in 2.0.8 (released Apr 14, 2026, 83 days before disclosure). - The latest release, 2.0.11, is not affected. ### [CVE-2025-48459](https://cve.now/CVE-2025-48459): Apache IoTDB: Deserialization of untrusted Data - Severity: Medium 5.3 - Published: Sep 24, 2025 - Affected: from 1.0.0, fixed in 2.0.5. - Fixed in 2.0.5 (released Aug 22, 2025, 33 days before disclosure). - The latest release, 2.0.11, is not affected. ### [CVE-2025-26864](https://cve.now/CVE-2025-26864): Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication - Severity: High 7.5 - Published: May 14, 2025 - Affected: from 0.10.0, fixed in 1.3.4; from 2.0.1b0, fixed in 2.0.2. - Fixed in 1.3.4 (released Apr 17, 2025, 27 days before disclosure) and 2.0.2 (released Apr 17, 2025, 27 days before disclosure). - The latest release, 2.0.11, is not affected. ### [CVE-2024-24780](https://cve.now/CVE-2024-24780): Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function - Severity: Critical 9.8 - Published: May 14, 2025 - Affected: from 1.0.0, fixed in 1.3.4. - Fixed in 1.3.4 (released Apr 17, 2025, 27 days before disclosure). - The latest release, 2.0.11, is not affected. ### [CVE-2023-46226](https://cve.now/CVE-2023-46226): Apache IoTDB: Remote Code Execution (RCE) risk via the UDF - Severity: Critical 9.8 - Published: Jan 15, 2024 - Affected: from 1.0.0, fixed in 1.3.0. - Fixed in 1.3.0 (released Jan 2, 2024, 13 days before disclosure). - The latest release, 2.0.11, is not affected. ### [CVE-2023-30771](https://cve.now/CVE-2023-30771): Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench - Severity: Critical 9.8 - Published: Apr 17, 2023 - Affected: all versions. - No fix released. The latest release, 2.0.11, is still affected. ### [CVE-2023-24831](https://cve.now/CVE-2023-24831): Apache IoTDB grafana-connector Login Bypass Vulnerability - Severity: Critical 9.8 - Published: Apr 17, 2023 - Affected: from 0.13.0, fixed in 0.13.5. - Fixed in 0.13.5 (released Mar 23, 2023, 25 days before disclosure). - The latest release, 2.0.11, is not affected. ### [CVE-2023-24829](https://cve.now/CVE-2023-24829): Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench - Severity: High 8.8 - Published: Jan 31, 2023 - Affected: from 0.13.0, fixed in 0.13.3. - Fixed in 0.13.3 (released Dec 19, 2022, 43 days before disclosure). - The latest release, 2.0.11, is not affected. ### [CVE-2023-24830](https://cve.now/CVE-2023-24830): Apache IoTDB Workbench: apache/iotdb-web-workbench: create a user without authorization - Severity: High 7.5 - Published: Jan 30, 2023 - Affected: from 0.13.0, fixed in 0.13.3. - Fixed in 0.13.3 (released Dec 19, 2022, 42 days before disclosure). - The latest release, 2.0.11, is not affected. ### [CVE-2022-43766](https://cve.now/CVE-2022-43766): Apache IoTDB prior to 0.13.3 allows DoS - Severity: High 7.5 - Published: Oct 26, 2022 - Affected: from 0.12.2, fixed in 0.13.3. - Fixed in 0.13.3 (released Dec 19, 2022, 54 days after disclosure). - The latest release, 2.0.11, is not affected. ### [CVE-2022-38369](https://cve.now/CVE-2022-38369): Login check vulnerability by session Id - Severity: Unrated - Published: Sep 5, 2022 - Affected: fixed in 0.13.1. - Fixed in 0.13.1 (released Aug 9, 2022, 27 days before disclosure). - The latest release, 2.0.11, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/apache-iotdb Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.