CVE-2026-28564— Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials
Possible ATT&CK Techniques 1AI
T1078 · Valid AccountsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache IoTDB | 1.0.0< 2.0.10 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-28564
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials
Source: NVD (National Vulnerability Database)
Vulnerability Description
Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credentials This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
不充分的会话过期机制
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache IoTDB | 1.0.0 ~ 2.0.10 | - |
II. Public POCs for CVE-2026-28564
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-28564
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-28564 (1)
Same Patch Batch · Apache Software Foundation · 2026-07-10 · 9 CVEs total
| CVE-2026-49844 | Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage | |
| CVE-2026-40454 | Apache IoTDB C++ client: Out-of-bounds reads in C++ client TsBlock deserializer crash clie | |
| CVE-2026-40452 | Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to un | |
| CVE-2026-40009 | Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themse | |
| CVE-2026-40008 | Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC | |
| CVE-2026-40007 | Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language pr | |
| CVE-2026-40006 | Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap | |
| CVE-2026-40005 | Apache IoTDB: Path Traversal in Pipe File Transfer Receiver |
IV. Related Vulnerabilities
Same product: Apache IoTDB
- CVE-2026-40452
Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery - CVE-2026-40009
Apache IoTDB: Authenticated users can escalate to full tree- - CVE-2026-40008
Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfe - CVE-2026-40007
Apache IoTDB: Unauthenticated unbounded recursion in IoTDB A - CVE-2026-40006
Apache IoTDB: Unauthenticated heap-exhaustion DoS via unboun
Same vendor: Apache Software Foundation
- CVE-2026-59245
Apache Airflow FAB provider: FAB auth manager: a DAG named " - CVE-2026-58065
Apache Airflow Git provider: Git provider hook defaults to S - CVE-2026-41041
Apache Gravitino: URL path injection via unencoded user-supp - CVE-2026-49876
Apache Gravitino: Authenticated SSRF in Gravitino JobManager - CVE-2026-49844
Apache Log4j API: Improper serialization of non-finite float
Same weakness: CWE-613
- CVE-2026-44383
Hydro-Québec Le Circuit Electrique charging station backend - CVE-2026-56665
ZITADEL: Missing Token Expiration (`exp`) Validation in JWT - CVE-2026-56664
ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) - CVE-2026-59219
Open WebUI: Realtime endpoints accept Redis-revoked JWTs aft - CVE-2026-49229
Actual: Disabled OpenID users keep access through existing s
V. Comments for CVE-2026-28564
No comments yet