CVE-2026-40452 | Incorrect Authorization, Improper Access Control vulnerabili…

Description

Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users. This issue affects Apache IoTDB: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

Metadata

CVE ID: CVE-2026-40452
State: PUBLISHED
Assigner: apache
Reserved: 2026-04-13 07:33 UTC
Published: 2026-07-10 07:16 UTC
Last updated: 2026-07-10 07:16 UTC
Primary CWE: CWE-863
CWE-863 Incorrect Authorization
Vendor / Product: Apache Software Foundation / Apache IoTDB
Sources: cve.org · NVD

Severity & Metrics

No CVSS data available.

Affected products (1)

Vendor	Product	Platform	Versions
Apache Software Foundation	Apache IoTDB	—	1.3.5 < 1.3.8, 2.0.5 < 2.0.10

Weakness (CWE)

CWE	Source	Description
CWE-284	cna	CWE-284 Improper Access Control
CWE-863	cna	CWE-863 Incorrect Authorization

References (1)

https://lists.apache.org/thread/04j2l6dosyboor4o2gvrzbrcrpllmh95