CVE-2026-28564: Apache IoTDB Auth Bypass Vulnerability

CVE-2026-28564 Overview

CVE-2026-28564 is an authentication bypass vulnerability in Apache IoTDB affecting the REST interface. The flaw stems from insufficient session expiration combined with an authentication bypass by capture-replay condition [CWE-294]. REST Basic Authentication accepts stale cached credentials, allowing attackers to reuse previously valid credentials after they should have been invalidated. The issue affects Apache IoTDB versions from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

Critical Impact
Remote attackers can bypass authentication over the network by replaying captured or cached credentials, gaining full read, write, and availability impact on Apache IoTDB deployments without user interaction.

Affected Products

Apache IoTDB versions 1.0.0 through 2.0.9
Apache IoTDB REST Basic Authentication interface
Deployments exposing the IoTDB REST API to untrusted networks

Discovery Timeline

2026-07-10 - CVE-2026-28564 published to the National Vulnerability Database
2026-07-10 - Apache Software Foundation disclosed the issue via the Apache Mailing List Thread
2026-07-10 - Coordinated advisory posted to the Openwall OSS Security Discussion
2026-07-10 - Last updated in the NVD database

Technical Details for CVE-2026-28564

Vulnerability Analysis

Apache IoTDB is a time-series database used for Internet of Things (IoT) workloads. The REST interface uses HTTP Basic Authentication to validate client requests. The vulnerable implementation caches credential validation results and does not correctly expire those cached entries. As a result, credentials that should no longer be valid continue to authenticate requests. An attacker on the network can capture a valid credential exchange and replay it later to gain access. The vulnerability requires no privileges and no user interaction, and it impacts confidentiality, integrity, and availability of the database.

Root Cause

The root cause is a flawed session and credential caching mechanism in the REST authentication path. The cache stores authentication results without enforcing correct expiration, refresh, or invalidation semantics. When a user changes a password, is disabled, or has permissions revoked, cached entries can continue to authorize requests. This design maps to [CWE-294] Authentication Bypass by Capture-replay because captured Basic Authentication headers remain usable beyond their intended lifetime.

Attack Vector

Exploitation occurs over the network against the Apache IoTDB REST endpoint. An attacker who observes or otherwise obtains a Basic Authentication header, including one obtained through legacy logs, misconfigured proxies, or a previously compromised account, can replay it against the REST API. The IoTDB server accepts the stale credential from its cache and grants access with the associated privileges. No exploit is publicly available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is available. See the Apache Mailing List Thread for technical details from the project maintainers.

Detection Methods for CVE-2026-28564

Indicators of Compromise

Successful REST API authentications using credentials for users that have been disabled, deleted, or had their passwords rotated
Repeated identical Authorization: Basic headers originating from unexpected source IP addresses
REST API access patterns that deviate from the historical baseline of client applications integrated with IoTDB

Detection Strategies

Inspect IoTDB REST access logs for authentication events that succeed after a credential change or account deactivation event
Correlate authentication events across IoTDB audit logs and upstream reverse proxy or API gateway logs to detect replay of identical Basic Authentication tokens
Alert on REST API activity from source addresses that have never previously interacted with IoTDB service accounts

Monitoring Recommendations

Forward Apache IoTDB REST and audit logs to a centralized logging platform and retain them for correlation
Track the version of Apache IoTDB running across all clusters and flag any instance below 2.0.10
Monitor for outbound data volumes from IoTDB nodes that exceed expected query workloads, which may indicate abuse of replayed credentials

How to Mitigate CVE-2026-28564

Immediate Actions Required

Upgrade all Apache IoTDB deployments to version 2.0.10 or later, which contains the vendor fix
Rotate all IoTDB user credentials after upgrading to invalidate any tokens that may have been captured
Restrict network exposure of the IoTDB REST endpoint to trusted management networks using firewall rules or a reverse proxy with allowlisting

Patch Information

The Apache IoTDB project has released version 2.0.10 to remediate CVE-2026-28564. The fix corrects credential cache expiration behavior in the REST Basic Authentication path so that stale cached credentials are no longer accepted. Upgrade guidance and release notes are available on the Apache Mailing List Thread.

Workarounds

Place the IoTDB REST API behind a reverse proxy that enforces its own authentication and short-lived tokens until the upgrade to 2.0.10 is complete
Disable the REST interface if it is not required for the deployment and rely on the native protocol with strict network segmentation
Reduce the operational window of any static credentials by rotating IoTDB passwords on a frequent schedule until patched

bash

# Configuration example: restrict IoTDB REST API to a management subnet using iptables
iptables -A INPUT -p tcp --dport 18080 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 18080 -j DROP

# Verify the running Apache IoTDB version before and after upgrade
curl -u <user>:<password> http://iotdb-host:18080/ping