CVE-2026-40452: Apache Software Foundation Apache Iotdb

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users. This issue affects Apache IoTDB: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

Affected products

• Apache Software Foundation Apache Iotdb: from 1.3.5, before 1.3.8 (fixed in 1.3.8); from 2.0.5, before 2.0.10 (fixed in 2.0.10)

Published 2026-07-10. Last modified 2026-07-10.