TL;DR The Apache Software Foundation disclosed 17 security flaws on October 21, 2026. These include 13 Apache Pulsar vulnerabilities and four Apache IoTDB bugs. The most severe issues include a 10.0 CVSS flaw in the retired Pulsar Manager tool. There is also a 9.2 CVSS token bypass in Pulsar, and a root privilege bypass in IoTDB. Therefore, administrators must upgrade their clusters immediately.

TL;DR Apache has fixed five security flaws in Apache IoTDB, an industrial IoT time-series database. The Apache Software Foundation rated all five as "important." The bugs range from privilege escalation to an unauthenticated denial-of-service, and version 2.0.10 fixes every one. Why it matters IoTDB stores sensor and telemetry data at scale. A breach can expose that data or take a node offline.

TL;DR Apache IoTDB has patched three flaws in its time-series database. The worst is a critical path traversal bug, CVE-2026-24014, scored 9.8. A second flaw allows an authentication bypass, and a third causes denial of service. Version 2.0.8 fixes all three. Why it matters Apache IoTDB stores sensor data for many industrial and IoT setups. Many plants run it at the edge and in the cloud.

Apache IoTDB versions 1.0.0 to 2.0.9 are affected.

Apache IoTDB, a database for IoT data, has a security issue that allows attackers to use old login credentials.

Apache IoTDB versions 1.0.0 to 2.0.9 have a security weakness that allows an attacker to load and execute arbitrary Java code.

Apache IoTDB allows an attacker to write files on the system if the internal RPC port is exposed to an untrusted network.

Apache IoTDB's authentication system can be tricked into accepting fake session IDs, allowing attackers to read sensitive time-series data without.