CVE-2026-40008

CVE-2026-40008: Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC

Vendor Apache Software Foundation

Product Apache IoTDB

Weakness CWE-470

Published July 10, 2026

Last update July 10, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

Key dates

02Disclosure timeline

July 10, 2026 CVE published

July 10, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-40008 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/470.html AskarLabs — CWE-470 write-up Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection)