CVE-2023-46226 is a critical severity (CVSS 9.8) remote code execution vulnerability in Apache IoTDB. Versions 1.0.0 through 1.2.2 are affected. Apache recommends upgrading to 1.3.0, which fixes the issue. The advisory lists no interim workaround, so plan the upgrade and limit network exposure of the database.
What's affected
Apache says IoTDB versions from 1.0.0 through 1.2.2 are affected, and that 1.3.0 fixes it. The Apache announcement we read rates it moderate, while NVD scores it 9.8 critical. That is a severity disagreement between sources, so we report both. The oss-security copy links the issue to the user defined function (UDF) feature and credits the reporter as Glassy of EagleCloud.
The advisory gives no further technical detail and no workaround. The NVD record assigns CWE-94, code injection.
The NVD record scores it 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-94 (code injection). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Find the IoTDB version on each node. You can check the release directory or package name, and the product also reports its version through its CLI and logs. Look for anything from 1.0.0 to 1.2.2.
Also check whether IoTDB ports are reachable from untrusted networks, and whether the user defined function feature is enabled in your configuration. Your deployment notes should say.
What to do now
- Inventory every IoTDB server and its version, including development clusters.
- Upgrade to 1.3.0 or later following the Apache upgrade notes, testing on a copy first.
- Keep IoTDB off the public internet and restrict access to application servers.
- Review who has accounts and privileges, and remove unused ones.
- Search server logs for unexpected function registrations or restarts.
Why it matters
Code injection means the server can be made to run code it was not meant to. For a time series database that collects data from many sensors and services, a compromised node can expose stored data and give a foothold in the network that feeds it.
The CVSS vector shows no privileges and no user action. Apache scores the same issue lower than NVD, which is a reason to read the advisory yourself rather than relying on a headline number. Either way, the fix is the same upgrade.
Quick check
Which versions are affected?
1.0.0 through 1.2.2. Version 1.3.0 contains the fix.
Do the sources agree on severity?
No. NVD says 9.8 critical, and the Apache announcement says moderate.
Sources
Last reviewed: 19 October 2026.
