What is GHSA-qx5v-jm63-wqfj?

GHSA-qx5v-jm63-wqfj is a security advisory published by GitHub Security Advisories with Critical severity. Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query...

Which CVE IDs does GHSA-qx5v-jm63-wqfj cover?

GHSA-qx5v-jm63-wqfj covers the following CVE IDs: CVE-2026-24013. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qx5v-jm63-wqfj?

GHSA-qx5v-jm63-wqfj has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

GHSA-qx5v-jm63-wqfjCriticalCVSS 9.1

Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query...

Vendor

GitHub Security Advisories

Published

July 6, 2026

Last Modified

July 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-24013 →

📋 Description

Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attacker can construct requests with a forged sessionId and, without performing openSession authentication, receive valid query results. This allows authentication bypass and unauthorized reading of time-series data.

This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.

Users are recommended to upgrade to version 2.0.8, which fixes the issue.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-24013
https://lists.apache.org/thread/6pwkgnqhbm56mvn309f87snm84s0b75y
http://www.openwall.com/lists/oss-security/2026/07/06/11
https://github.com/advisories/GHSA-qx5v-jm63-wqfj