CVE-2025-26864

EPSS 0.49%

Apache IoTDB Discloses Sensitive Information via Log Files

Published: 5/14/2025Modified: 7/2/2025

Also known as:GHSA-5fc3-pqf2-57cxPYSEC-2025-60

Description

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB. This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2. Users are recommended to upgrade to version 1.3.4 and 2.0.2, which fix the issue.

Affected packages (3)

Maven/org.apache.iotdb:node-commons>= 0.10.0, < 1.3.4
PyPI/apache-iotdb>= 0.10.0, < 1.3.4
PyPI/apache-iotdb>= 0.10.0, < 1.3.4

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

References (7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-26864
PATCHhttps://github.com/apache/iotdb
WEBhttps://github.com/apache/iotdb/commit/34fcaff6b72470d5ad369307dde7fae8897aea7e
WEBhttps://github.com/apache/iotdb/pull/14863
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2025-60.yaml
WEBhttps://lists.apache.org/thread/2kcjnlypppk8qjh17dpz0jvkcpn6l162
WEBhttp://www.openwall.com/lists/oss-security/2025/05/14/4