GitHub Advisoryadvisory · Maven, PyPI

GHSA-5fc3-pqf2-57cx Apache IoTDB Discloses Sensitive Information via Log Files

MEDIUM Published 2025-05-14 Modified 2025-07-02 Official page ↗
Aliases
CVE-2025-26864
Ecosystem
Maven, PyPI
Packages
org.apache.iotdb:node-commons, apache-iotdb
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Weaknesses
CWE-200
Reviewed
2025-05-15

Affected packages

• Maven org.apache.iotdb:node-commons: >= 0.10.0, < 1.3.4 → fixed in 1.3.4 • Maven org.apache.iotdb:node-commons: >= 2.0.1-beta, < 2.0.2 → fixed in 2.0.2 • PyPI apache-iotdb: >= 0.10.0, < 1.3.4 → fixed in 1.3.4 • PyPI apache-iotdb: >= 2.0.1b0, < 2.0.2 → fixed in 2.0.2

Description

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB. This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2. Users are recommended to upgrade to version 1.3.4 and 2.0.2, which fix the issue.

Related

Alias · CVE (1)

  • CVE-2025-26864 Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References