{"id":86362,"date":"2026-01-29T09:14:58","date_gmt":"2026-01-29T09:14:58","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-26864-unauthorized-exposure-of-sensitive-information-in-apache-iotdb","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-26864-unauthorized-exposure-of-sensitive-information-in-apache-iotdb\/","title":{"rendered":"CVE-2025-26864: Unauthorized Exposure of Sensitive Information in Apache IoTDB<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

CVE-2025-26864 refers to an issue that allows the unauthorized exposure of sensitive information in Apache IoTDB’s OpenIdAuthorizer. The vulnerability affects versions 0.10.0 through 1.3.3 and 2.0.1-beta before 2.0.2. It poses a significant risk to the integrity and security of systems leveraging these versions of Apache IoTDB, potentially leading to data leakage or system compromise.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-26864
\nSeverity: High (7.5 CVSS)
\nAttack Vector: Network
\nPrivileges Required: Low
\nUser Interaction: None
\nImpact: Exposure of sensitive information to an unauthorized actor, potential system compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Apache IoTDB | 0.10.0 through 1.3.3
\nApache IoTDB | 2.0.1-beta before 2.0.2<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability stems from the OpenIdAuthorizer component of Apache IoTDB, which incorrectly handles sensitive information. This flaw allows an attacker to exploit the system remotely, gaining unauthorized access to sensitive information. The malicious actor can then insert this sensitive information into the log file, potentially leading to system compromise or unauthorized data leakage.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

The following is a conceptual example of how the vulnerability might be exploited:<\/p>\n

GET \/IoTDB\/OpenIdAuthorizer?info=Sensitive HTTP\/1.1\nHost: vulnerable_host.com<\/code><\/pre>\n
In this example, an attacker sends a GET request to the OpenIdAuthorizer component of a vulnerable Apache IoTDB instance, attempting to retrieve sensitive information.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview CVE-2025-26864 refers to an issue that allows the unauthorized exposure of sensitive information in Apache IoTDB’s OpenIdAuthorizer. The vulnerability affects versions 0.10.0 through 1.3.3 and 2.0.1-beta before 2.0.2. It poses a significant risk to the integrity and security of systems leveraging these versions of Apache IoTDB, potentially leading to data leakage or system compromise. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86362","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t