← CVE Intelligence

CVE-2026-40452

Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users PUBLISHED

Description (CNA)

Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users. This issue affects Apache IoTDB: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

Affected (CNA)

Vendor / productVersions
Apache Software Foundation / Apache IoTDBaffected 1.3.5 before 1.3.8; affected 2.0.5 before 2.0.10

CWE

CWE-863, CWE-284

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.