Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor

published 2026-07-10 4 mo ago modified 2026-10-25 15 d ago also EUVD-2026-42837

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 29%
public exploits: 0; none known

Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor.

This issue affects Apache IoTDB: from 2.0.8 before 2.0.10.

Users are recommended to upgrade to version 2.0.10, which fixes the issue.

Patch / fix

fixed in 1

Apache Software Foundation Apache IoTDB 2.0.10

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 4 mo ago (2026-07-10)

Exploit prediction

0.35% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

Apache Software Foundation Apache IoTDB

Classification

Weakness

CWE-269 Improper Privilege Management
CWE-284 Improper Access Control

References

lists.apache.org /thread/65hh7dh28rcxlzdzwdpt630321tr8b61
vendor-advisory
openwall.com /lists/oss-security/2026/07/10/6

Sources

CVE List CVE-2026-40009
NVD CVE-2026-40009

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary