CVE-2026-28564: Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials

[Haonan Hou <haonan () apache org>]

Severity: important 

Affected versions:

- Apache IoTDB 1.0.0 before 2.0.10

Description:

Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB.
REST Basic Authentication Accepts Stale Cached Credentials


This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.

Users are recommended to upgrade to version 2.0.10, which fixes the issue.

Credit:

Aristore (https://github.com/aristorechina) (finder)

References:

https://iotdb.apache.org
https://www.cve.org/CVERecord?id=CVE-2026-28564