CVE-2026-40008

CRITICAL 9.8

Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC

CVSS Score

9.8

EPSS Score

0.3%

EPSS Percentile

17th

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

CWE	CWE-470
Vendor	apache software foundation
Product	apache iotdb
Published	Jul 10, 2026
Last Updated	Jul 10, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache iotdb

Be the first to know when new critical vulnerabilities affecting apache software foundation apache iotdb are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache IoTDB

1.0.0 < 2.0.10

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/fm8cpvzbox2qqy99ztglm8wkk1nrg9ng openwall.com: http://www.openwall.com/lists/oss-security/2026/07/10/5

Credits

Andrea Cosentino