CVE-2026-24014: apache software foundation apache iotdb Improper Access Control
Vulnerability summary
CVE-2026-24014 is a critical (CVSS 9.8) Improper Access Control vulnerability in apache software foundation apache iotdb. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 51.8% of scored vulnerabilities.
Timeline
- 06-07-2026PublishedVulnerability first disclosed.
- 06-07-2026Last modifiedVulnerability information updated.
Description
Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file write with the permissions of the IoTDB process. This issue affects Apache IoTDB: from 1.3.3 before 2.0.8. Users are recommended to upgrade to version 2.0.8, which fixes the issue.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · PypiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.69%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
0.00 pp
From 0.69% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Affected systems
Apache1 product
- iotdb≥ 1.3.3, < 2.0.8
Apache software foundation1 product
- apache iotdb≥ 1.3.3, < 2.0.8
PyPI1 product
- apache-iotdb≥ 1.3.3, < 2.0.8
3 vendors · 3 products