CVE-2026-24015
published 2026-03-09CVE-2026-24015: A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7. Users are recommended to upgrade to version…
PriorityP356critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.58%
44.0th percentile
A vulnerability in Apache IoTDB.
This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.
Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | iotdb | >= 1.0.0 < 1.3.7 | 1.3.7 |
| apache | iotdb | >= 2.0.0 < 2.0.7 | 2.0.7 |
| apache_software_foundation | apache_iotdb | >= 1.0.0 < 1.3.7 | 1.3.7 |
| apache_software_foundation | apache_iotdb | >= 2.0.0 < 2.0.7 | 2.0.7 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Apache IoTDB has an Insecure Default Configuration Vulnerability
osv·2026-03-09
CVE-2026-24015 [CRITICAL] Apache IoTDB has an Insecure Default Configuration Vulnerability
Apache IoTDB has an Insecure Default Configuration Vulnerability
A vulnerability in Apache IoTDB.
This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.
Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.
GHSA
Apache IoTDB has an Insecure Default Configuration Vulnerability
ghsa·2026-03-09
CVE-2026-24015 [CRITICAL] CWE-1327 Apache IoTDB has an Insecure Default Configuration Vulnerability
Apache IoTDB has an Insecure Default Configuration Vulnerability
A vulnerability in Apache IoTDB.
This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.
Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.
No detection rules found.
No public exploits indexed.
2026-03-09
Published