CVE-2026-40008

CRITICAL9.8

Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC

Published Jul 10, 2026

Modified 5 days ago

Details

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting.

This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.

Users are recommended to upgrade to version 2.0.10, which fixes the issue.

References

WEB

http://www.openwall.com/lists/oss-security/2026/07/10/5

ADVISORY

https://lists.apache.org/thread/fm8cpvzbox2qqy99ztglm8wkk1nrg9ng

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-40008

CVSS Analysis

CVSS v3.1

9.8