CVE-2026-24713

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24713", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-01-26T02:40:07.150Z", "datePublished": "2026-03-09T08:59:59.259Z", "dateUpdated": "2026-03-10T17:55:45.832Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache IoTDB", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "1.3.7", "status": "affected", "version": "1.0.0", "versionType": "semver"}, {"lessThan": "2.0.7", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Yongzhi Liu of Tencent YunDing Security Lab"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Input Validation vulnerability in Apache IoTDB.</p><p>This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.</p><p>Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.</p>"}], "value": "Improper Input Validation vulnerability in Apache IoTDB.\n\nThis issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.\n\nUsers are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-03-09T08:59:59.259Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/vopgv6y2ccw403b0zv7rvojjrh7x1j5p"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache IoTDB: JEXL Expression Injection Vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/09/4"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-09T09:19:57.439Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T17:55:24.372118Z", "id": "CVE-2026-24713", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T17:55:45.832Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/09/4"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-09T09:19:57.439Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-24713", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-10T17:55:24.372118Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T17:54:40.479Z"}}], "cna": {"title": "Apache IoTDB: JEXL Expression Injection Vulnerability", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Yongzhi Liu of Tencent YunDing Security Lab"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache IoTDB", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.3.7", "versionType": "semver"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/vopgv6y2ccw403b0zv7rvojjrh7x1j5p", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Input Validation vulnerability in Apache IoTDB.\n\nThis issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.\n\nUsers are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Improper Input Validation vulnerability in Apache IoTDB.</p><p>This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.</p><p>Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-03-09T08:59:59.259Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24713", "state": "PUBLISHED", "dateUpdated": "2026-03-10T17:55:45.832Z", "dateReserved": "2026-01-26T02:40:07.150Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-03-09T08:59:59.259Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache IoTDB", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "1.3.7", "status": "affected", "version": "1.0.0", "versionType": "semver"}, {"lessThan": "2.0.7", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*", "matchCriteriaId": "3C675206-3D0A-4C1F-B355-DA87C0409DA8", "versionEndExcluding": "1.3.7", "versionStartIncluding": "1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*", "matchCriteriaId": "40FC7BFC-A8E1-4109-A0FB-2002CDC205A6", "versionEndExcluding": "2.0.7", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Input Validation vulnerability in Apache IoTDB.\n\nThis issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.\n\nUsers are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de validaci\u00f3n de entrada indebida en Apache IoTDB.\n\nEste problema afecta a Apache IoTDB: desde 1.0.0 hasta antes de 1.3.7, desde 2.0.0 hasta antes de 2.0.7.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 1.3.7 o 2.0.7, lo que corrige el problema."}], "id": "CVE-2026-24713", "lastModified": "2026-06-17T10:23:28.180", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24713", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T17:55:24.372118Z", "version": "2.0.3"}}]}, "published": "2026-03-09T09:16:02.933", "references": [{"source": "security@apache.org", "tags": ["Mailing List"], "url": "https://lists.apache.org/thread/vopgv6y2ccw403b0zv7rvojjrh7x1j5p"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/03/09/4"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security@apache.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-917"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,1.3.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.0.7)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache IoTDB", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "iotdb", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-17T11:54:17.688571+00:00", "value": {"mitigation_remediation": ["Upgrade Apache IoTDB to version 1.3.7 or later 2.0.7 or newer, which contains the full fix for the injection flaw", "If an upgrade is not immediately possible, restrict network access to the IoTDB query interface to only trusted hosts and enforce strict role\u2011based permissions to limit who can submit arbitrary queries", "Continuously monitor query logs for unexpected JEXL patterns and apply input validation rules to reject or sanitize expressions that contain suspicious constructs"], "summary": {"action": "Immediate Patch", "impact": "Input Validation Flaw"}, "threat_synthesis": {"affected_systems": "Affected installations include Apache IoTDB versions 1.0.0 through 1.3.6 and all releases from 2.0.0 up to 2.0.6. Users of these version ranges are vulnerable and need remediation before deploying new features or data ingestion pipelines.", "description_and_impact": "Apache IoTDB suffers from an improper input validation flaw that allows attackers to inject malicious JEXL expressions through query inputs. The injection vulnerability may enable manipulation of the server\u2019s processing of expressions, potentially exposing the database to unauthorized processing of user\u2011supplied data. The flaw is rooted in the CWE\u201120 and CWE\u2011917 weaknesses.", "risk_and_exploitability": "The vulnerability has a CVSS score of 9.8, indicating critical severity, but its EPSS score is less than 1%, suggesting a low likelihood of exploitation in the wild. It is not currently listed in the CISA KEV catalog. Attackers could send crafted queries containing malicious JEXL syntax over the network, assuming they have query access. If successful, the injected expression could affect the server\u2019s processing, though the exact impact is not specified in the advisory."}}}}, "created": "2026-03-10T14:09:54.782634+00:00", "updated": "2026-04-17T12:00:11.778858+00:00", "vendors": ["apache", "apache$PRODUCT$iotdb"]}