Apache IoTDB Discloses Sensitive Information via Log Files
Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB. This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2. Users are recommended to upgrade to version 1.3.4 and 2.0.2, which fix the issue.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-26864US | — | — | ||
Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB.
This issue affe… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2025/05/14/4WEB
- https://github.com/apache/iotdbPACKAGE
- https://github.com/apache/iotdb/commit/34fcaff6b72470d5ad369307dde7fae8897aea7eWEB
- https://github.com/apache/iotdb/pull/14863WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2025-60.yamlWEB
- https://lists.apache.org/thread/2kcjnlypppk8qjh17dpz0jvkcpn6l162WEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-26864ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan