CVE-2026-24015

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24015", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-01-20T03:23:00.407Z", "datePublished": "2026-03-09T08:57:45.745Z", "dateUpdated": "2026-03-10T17:58:18.381Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache IoTDB", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "1.3.7", "status": "affected", "version": "1.0.0", "versionType": "semver"}, {"lessThan": "2.0.7", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Mapta / BugBunny_ai"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A vulnerability in Apache IoTDB.</p><p>This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.</p><p>Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.</p>"}], "value": "A vulnerability in Apache IoTDB.\n\nThis issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.\n\nUsers are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1327", "description": "CWE-1327 Binding to an Unrestricted IP Address", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-03-09T08:57:45.745Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/j769ywdqm46zl3oz5lbffsldklg0ow7p"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache IoTDB: Insecure Default Configuration Vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/09/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-09T09:19:55.308Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T17:57:58.449781Z", "id": "CVE-2026-24015", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T17:58:18.381Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/09/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-09T09:19:55.308Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-24015", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-10T17:57:58.449781Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T17:57:18.910Z"}}], "cna": {"title": "Apache IoTDB: Insecure Default Configuration Vulnerability", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Mapta / BugBunny_ai"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache IoTDB", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.3.7", "versionType": "semver"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/j769ywdqm46zl3oz5lbffsldklg0ow7p", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability in Apache IoTDB.\n\nThis issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.\n\nUsers are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>A vulnerability in Apache IoTDB.</p><p>This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.</p><p>Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1327", "description": "CWE-1327 Binding to an Unrestricted IP Address"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-03-09T08:57:45.745Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24015", "state": "PUBLISHED", "dateUpdated": "2026-03-10T17:58:18.381Z", "dateReserved": "2026-01-20T03:23:00.407Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-03-09T08:57:45.745Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache IoTDB", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "1.3.7", "status": "affected", "version": "1.0.0", "versionType": "semver"}, {"lessThan": "2.0.7", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*", "matchCriteriaId": "3C675206-3D0A-4C1F-B355-DA87C0409DA8", "versionEndExcluding": "1.3.7", "versionStartIncluding": "1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*", "matchCriteriaId": "40FC7BFC-A8E1-4109-A0FB-2002CDC205A6", "versionEndExcluding": "2.0.7", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in Apache IoTDB.\n\nThis issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.\n\nUsers are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue."}, {"lang": "es", "value": "Una vulnerabilidad en Apache IoTDB.\n\nEste problema afecta a Apache IoTDB: desde la 1.0.0 anterior a la 1.3.7, desde la 2.0.0 anterior a la 2.0.7.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 1.3.7 o 2.0.7, que soluciona el problema."}], "id": "CVE-2026-24015", "lastModified": "2026-06-17T10:22:28.527", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24015", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T17:57:58.449781Z", "version": "2.0.3"}}]}, "published": "2026-03-09T09:16:02.757", "references": [{"source": "security@apache.org", "tags": ["Mailing List"], "url": "https://lists.apache.org/thread/j769ywdqm46zl3oz5lbffsldklg0ow7p"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/03/09/5"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1327"}], "source": "security@apache.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,1.3.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.0.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache IoTDB", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "iotdb", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-18T09:42:17.293059+00:00", "value": {"mitigation_remediation": ["Upgrade Apache IoTDB to at least version 1.3.7 if running a 1.x series or 2.0.7 if running a 2.x series. ", "If a patch cannot be applied immediately, review and modify the default configuration on the deployed instance to disable unauthenticated access, remove default accounts, and close unused ports. ", "Restrict network exposure to the IoTDB service by placing it behind appropriate firewalls, VPNs, or access controls so that only trusted administrators can reach the database."], "summary": {"action": "Patch Now", "impact": "Unauthenticated or unauthorized access through insecure default settings"}, "threat_synthesis": {"affected_systems": "All Apache IoTDB 1.x releases before 1.3.7 and all 2.x releases before 2.0.7 are affected. Organizations should verify the installed component version and determine whether it falls within the vulnerable range.", "description_and_impact": "Apache IoTDB releases prior to 1.3.7 and 2.0.7 contain insecure default configuration that may allow an attacker to connect to the database service without proper authentication or to modify configuration values. The associated CWE\u20111327 indicates that input or service parameters are not adequately validated, which can lead to unauthorized configuration changes. The CVSS score of 9.8 reflects the potential for severe disruption, including loss of confidentiality, integrity, or availability, if the insecure defaults are abused.", "risk_and_exploitability": "The EPSS score of less than 1\u202f% indicates that the vulnerability is not frequently exploited in the wild and it is not currently listed in CISA\u2019s KEV catalog. Nevertheless, the high severity and the nature of the flaw mean that an attacker who can reach the IoTDB service over the network could potentially bypass authentication or alter configuration settings, using the default credentials or unprotected ports. No documented workaround exists, so the only effective mitigation is to apply the vendor\u2019s patch or to eliminate the insecure defaults as a temporary measure."}}}}, "created": "2026-03-10T14:09:55.701914+00:00", "updated": "2026-04-18T09:45:25.841134+00:00", "vendors": ["apache", "apache$PRODUCT$iotdb"]}