CVE-2026-28564 - Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials

Back Back to CVE browser

CRITICAL

Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials

Published Jul 10, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 0.68%

Description

Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credentials

This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.

Users are recommended to upgrade to version 2.0.10, which fixes the issue.

Affected products

Vendor Apache Software Foundation Product Apache IoTDB Default
unaffected
Affected
- ≥ 1.0.0, < 2.0.10

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Apache Software Foundation	Apache IoTDB	unaffected	Affected ≥ 1.0.0, < 2.0.10

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-294

CWE-613

References (3)

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2026/07/10/1
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42832		Advisory
https://lists.apache.org/thread/l38wpy7flvvfwv4rkps87l5z8gprnfy0		vendor-advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner apache

Published Jul 10, 2026

Updated Jul 10, 2026

Reserved Mar 2, 2026

Link CVE-2026-28564

CISA Vulnrichment

Updated Jul 10, 2026

NVD

Status Deferred

Modified Jul 10, 2026

Link CVE-2026-28564

Red Hat

No data

ENISA EUVD

Assigner apache

Published Jul 10, 2026

Updated Jul 10, 2026

Link EUVD-2026-42832

GitHub

No data