CVE-2026-40009

6.5 Moyenne

Publiée le 10/07/2026 à 10:16 · Modifiée le 10/07/2026 à 21:17 · Analyse NVD reportée · Source : security@apache.org

Description

Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor. This issue affects Apache IoTDB: from 2.0.8 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

Traduire en français

Produits concernés

Apache Software Foundation Apache IoTDB

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-269
CWE-284

Références

https://lists.apache.org/thread/65hh7dh28rcxlzdzwdpt630321tr8b61
http://www.openwall.com/lists/oss-security/2026/07/10/6

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories