CVE-2026-40008
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.60%
- CWE
- CWE-470
- Published
- 2026-07-10
- Last modified
- 2026-07-10
Affected products
- Apache Software Foundation Apache IoTDB
Weakness type
Related vulnerabilities
- CVE-2026-41871 — Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)
- CVE-2026-41870 — Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)
- CVE-2026-58400 — GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter
- CVE-2026-19032 — jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path
- CVE-2026-55559 — Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)
- CVE-2026-82078 — PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector
- CVE-2026-54614 — DebugKit: MailPreview contains unsafe reflection
- CVE-2026-79784 — Vocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model Configuration