CVE-2026-24713 is a critical (CVSS 9.8) improper input validation flaw in Apache IoTDB, titled a JEXL expression injection in the announcement. Versions 1.0.0 before 1.3.7 and 2.0.0 before 2.0.7 are affected. Apache recommends upgrading to 1.3.7 or 2.0.7, so plan that upgrade now.
What's affected
The Apache announcement lists two affected ranges: IoTDB 1.0.0 before 1.3.7, and 2.0.0 before 2.0.7. Users are recommended to upgrade to 1.3.7 or 2.0.7. Apache rates the severity as important, while the CVSS score is 9.8.
The announcement's subject line names it a JEXL Expression Injection Vulnerability, and the text itself says improper input validation. The record's weakness list pairs CWE-20 with CWE-917, which is the class for injection into an expression language. The CVSS vector needs no privileges and no user interaction.
The announcement does not give more technical detail, so I will not guess at the mechanism.
How to check if you're exposed
Check the version of every IoTDB node. From the installation, the version appears in the distribution folder name and in the logs on startup. In containers, look at the image tag:
docker ps --format '{{.Image}}' | grep -i iotdb
Compare with the two ranges. Remember that IoTDB often sits behind industrial data collection, so ask your operations teams where it runs.
For a quick look at your own dependencies, Safeguard's free in-browser dependency scan at https://gold.safeguard.sh/scan checks them against known CVEs in your browser.
What to do now
- Upgrade to 1.3.7 if you run the 1.x line, or to 2.0.7 if you run the 2.x line.
- Do not expose IoTDB ports to untrusted networks.
- Restrict who can connect to the database, and use authentication on every instance.
- Take a backup before the upgrade and test on a copy first.
- Watch the Apache IoTDB site for follow up notes.
Why it matters
Expression languages such as JEXL let an application evaluate small programs at runtime. If user input reaches the evaluator without checks, the input can become code. That is the pattern behind CWE-917, and it often ends in code execution on the server.
The broad impact scores reflect that a database server holds data and often runs with wide access to its host. Time series databases tend to be deployed quietly by operations teams, which makes them easy to miss in a patch cycle. The CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Reading the announcement carefully
The Apache announcement is short, and that tells you something. It names the class, a JEXL expression injection, the affected ranges and the fixed releases, and leaves out the mechanism. That is common practice for a first disclosure, and it means you should work from what is stated.
JEXL is the Java Expression Language library. Applications use expression languages to evaluate small formulas that users or configuration supply. The risk with any of them is the same: if input that an attacker controls can reach the evaluator, the input can reach whatever the evaluator can call. The CWE list on the record, input validation and expression language injection, matches that.
Before you upgrade
IoTDB deployments are often built into data pipelines by a different team than the one that runs servers. Find them first. Look for processes and containers named iotdb, and for the default client and cluster ports in your firewall rules and network scans. For each, record the version and which line it is on, 1.x or 2.x, because the fixed versions differ.
Plan the upgrade as a database upgrade, not a package bump. Take a backup, test on a copy of the data, check client compatibility, and schedule a window. For clusters, read the project's upgrade notes for the order in which nodes should change.
While you plan
Limit who can connect. The database should not be reachable from the internet, and clients should come from known application hosts. Enable authentication and remove default accounts. If you can, run the service as an unprivileged user with access only to its data directory.
Afterwards
Check that the new version is the one running, not just the one installed. Rolling upgrades sometimes leave an old node behind. Then add IoTDB to your regular inventory so the next announcement reaches an owner quickly.
Quick check
Which versions fix it?
1.3.7 for the 1.x line and 2.0.7 for the 2.x line.
What kind of flaw is it?
Apache's announcement calls it a JEXL expression injection and describes it as improper input validation.
Sources
Last reviewed: 19 October 2026.
