CVE-2026-40452

7.5 Élevée

Publiée le 10/07/2026 à 10:16 · Modifiée le 10/07/2026 à 21:17 · Analyse NVD reportée · Source : security@apache.org

Description

Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users. This issue affects Apache IoTDB: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

Traduire en français

Produits concernés

Apache Software Foundation Apache IoTDB

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-284
CWE-863

Références

https://lists.apache.org/thread/04j2l6dosyboor4o2gvrzbrcrpllmh95
http://www.openwall.com/lists/oss-security/2026/07/10/7

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories