CVE-2026-28564 Apache Software Foundation CVE debrief

Who should care

Users of Apache IoTDB versions from 1.0.0 to 2.0.9 should upgrade to version 2.0.10 to address the vulnerability. This includes operators, administrators, and security teams responsible for managing and securing Apache IoTDB systems. The vulnerability's impact is significant, as it allows attackers to bypass authentication and potentially gain unauthorized access to Apache IoTDB systems.

Technical summary

The vulnerability is caused by insufficient session expiration and authentication bypass by capture-replay in Apache IoTDB's REST Basic Authentication. This allows attackers to bypass authentication and potentially gain unauthorized access. The issue has a CVSS score of 9.8 and is considered critical. The vulnerability affects Apache IoTDB versions from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10 to fix the issue.

Defensive priority

High

Recommended defensive actions

• Upgrade Apache IoTDB to version 2.0.10 or later
• Review and update authentication and session management configurations
• Monitor for suspicious activity and implement additional security measures
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-10T08:16:21.897Z and last modified on 2026-07-10T16:16:28.493Z. The NVD entry is currently Deferred. The vulnerability affects Apache IoTDB versions from 1.0.0 before 2.0.10, and users are recommended to upgrade to version 2.0.10 to fix the issue. Evidence of the vulnerability's existence and impact is based on the official CVE record and NVD entry.

Official resources