CVE-2026-40009
Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor
CVSS Score
6.5
EPSS Score
0.1%
EPSS Percentile
3th
Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor. This issue affects Apache IoTDB: from 2.0.8 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.
| CWE | CWE-269 CWE-284 |
| Vendor | apache software foundation |
| Product | apache iotdb |
| Published | Jul 10, 2026 |
| Last Updated | Jul 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache iotdb
Be the first to know when new medium vulnerabilities affecting apache software foundation apache iotdb are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache IoTDB
2.0.8 < 2.0.10
References
Credits
bugbunny.ai