CVE-2026-40452
Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users
CVSS Score
7.5
EPSS Score
0.1%
EPSS Percentile
4th
Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users. This issue affects Apache IoTDB: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.
| CWE | CWE-863 CWE-284 |
| Vendor | apache software foundation |
| Product | apache iotdb |
| Published | Jul 10, 2026 |
| Last Updated | Jul 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache iotdb
Be the first to know when new high vulnerabilities affecting apache software foundation apache iotdb are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache IoTDB
1.3.5 < 1.3.8 2.0.5 < 2.0.10
References
Credits
bugbunny.ai