CVE-2026-40452: Apache IoTDB Auth Bypass Vulnerability

CVE-2026-40452 Overview

CVE-2026-40452 is an authorization bypass vulnerability in Apache IoTDB that exposes last-value time-series data through the /rest/v2/fastLastQuery REST endpoint. The flaw allows authenticated users without proper permissions to read data they should not access. The Apache Software Foundation classifies this issue under CWE-284: Improper Access Control.

The vulnerability affects Apache IoTDB versions from 1.3.5 before 1.3.8, and from 2.0.5 before 2.0.10. Apache has released version 2.0.10 as the remediation.

Critical Impact
Any authenticated IoTDB user can retrieve last-value measurements from time-series they lack authorization to read, resulting in exposure of sensitive telemetry, industrial sensor readings, or operational data.

Affected Products

Apache IoTDB versions 1.3.5 through 1.3.7
Apache IoTDB versions 2.0.5 through 2.0.9
Deployments exposing the REST v2 API endpoint

Discovery Timeline

2026-07-10 - CVE-2026-40452 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-40452

Vulnerability Analysis

Apache IoTDB is a time-series database purpose-built for Internet of Things (IoT) workloads. The database exposes a REST v2 API layer that mirrors query capabilities available through native protocols. The /rest/v2/fastLastQuery endpoint provides an optimized path to retrieve the most recent value for one or more measurement paths.

The endpoint validates that the caller is authenticated but fails to enforce fine-grained path-level authorization checks that other IoTDB query endpoints apply. Any authenticated principal can submit a fastLastQuery request referencing measurement paths outside their assigned role permissions and receive the last-value results.

This breaks the confidentiality guarantees of IoTDB's role-based access control model. In multi-tenant deployments, low-privilege users can enumerate device paths and pull the latest reading from any series in the database.

Root Cause

The root cause is a missing authorization check in the request handler for /rest/v2/fastLastQuery. The code path that services fast last-value lookups skipped the permission validation logic invoked by equivalent SQL and standard REST query paths. The CVSS vector reflects this behavior with a network attack vector, low complexity, and no user interaction required beyond valid credentials.

Attack Vector

An attacker with any valid IoTDB account, including a minimally provisioned read-only user, sends an HTTP POST request to the /rest/v2/fastLastQuery endpoint. The request body specifies target time-series paths using standard IoTDB path syntax such as root.<database>.<device>.<measurement>. The server returns the last recorded value for each requested path without validating that the caller holds read privileges on those paths.

The vulnerability cannot be used to modify data or crash the service. Confidentiality is the only impacted security property, as reflected in the C:H/I:N/A:N CVSS metrics.

No verified public exploit code is available. See the Apache Mailing List Discussion and the OpenWall OSS Security Update for the vendor advisory and technical details.

Detection Methods for CVE-2026-40452

Indicators of Compromise

HTTP POST requests to /rest/v2/fastLastQuery from user accounts that hold no explicit read grants on the queried paths.
Unexpected volume of fastLastQuery requests from a single authenticated principal targeting many distinct measurement paths.
Access log entries showing successful 200 responses to fastLastQuery requests referencing paths outside the caller's assigned role scope.

Detection Strategies

Enable IoTDB audit logging and correlate authenticated principals against the measurement paths they query through the REST v2 API.
Compare fastLastQuery request patterns against the account's expected data domain, flagging cross-tenant or cross-device enumeration.
Ingest IoTDB REST access logs into a SIEM and alert on any use of /rest/v2/fastLastQuery originating from non-service accounts pending patch deployment.

Monitoring Recommendations

Instrument the reverse proxy or API gateway fronting IoTDB to record full request URIs, authenticated user identity, and response sizes.
Baseline normal query behavior per role and alert on deviations in path breadth or request frequency.
Monitor for scanning behavior such as sequential enumeration of root.* paths through the REST API.

How to Mitigate CVE-2026-40452

Immediate Actions Required

Upgrade Apache IoTDB to version 2.0.10, which contains the vendor fix for the authorization bypass.
Restrict network exposure of the REST v2 API to trusted management networks until patching completes.
Rotate credentials for any IoTDB accounts that were provisioned during the exposure window if audit logs suggest misuse.

Patch Information

Apache has released Apache IoTDB 2.0.10 to remediate CVE-2026-40452. Operators running the 1.3.x branch must migrate forward, as the advisory identifies only 2.0.10 as containing the fix. Refer to the Apache Mailing List Discussion for the vendor announcement and release artifacts.

Workarounds

Block access to /rest/v2/fastLastQuery at a reverse proxy or web application firewall until the upgrade is complete.
Disable the REST v2 API in iotdb-common.properties if it is not required by client applications.
Restrict authenticated IoTDB user accounts to the minimum set required for operations and remove unused accounts.

bash

# Example nginx rule to block the vulnerable endpoint at the edge
location = /rest/v2/fastLastQuery {
    return 403;
}