CVE-2025-26795: apache software foundation apache iotdb jdbc driver
Vulnerability summary
CVE-2025-26795 is a high (CVSS 7.5) vulnerability in apache software foundation apache iotdb jdbc driver. EPSS estimates a 0.75% chance of exploitation in the next 30 days, higher than 53.9% of scored vulnerabilities.
Timeline
- 14-05-2025PublishedVulnerability first disclosed.
- 19-05-2025Last modifiedVulnerability information updated.
Description
Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in Apache IoTDB JDBC driver. This issue affects iotdb-jdbc: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2. Users are recommended to upgrade to version 2.0.2 and 1.3.4, which fix the issue.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.75%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
+0.02 pp
From 0.72% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache1 product
- iotdb≥ 0.10.0, < 1.3.4 | ≥ 2.0.1, < 2.0.2
Apache software foundation1 product
- apache iotdb jdbc driver≥ 0.10.0, ≤ 1.3.3 | ≥ 2.0.1-beta, < 2.0.2
Org.apache.iotdb1 product
- iotdb-jdbc≥ 0.10.0, < 1.3.4 | ≥ 2.0.1-beta, < 2.0.2
3 vendors · 3 products
References
8 links
- github.com/apache/iotdbPACKAGE