Security Advisory

About 12 min

Security Advisory

This page describes security vulnerabilities fixed in TimechoDB, the affected versions, and the corresponding fixed versions. Severity levels are listed according to the CVSS v3.1 scores shown.

1. Reporting Vulnerabilities

If you discover a potential security vulnerability in TimechoDB, please report it using the following contact information. To help the security team verify and assess the issue, include as much detail and supporting material as possible in your email.

Reporting email: security@timecho.com
Suggested report contents: Provide key information, including the affected product and module names, the vulnerability scenario, observed behavior, and steps to reproduce. Attach any screenshots, error logs, or other supporting material to help us verify the issue more efficiently.

2. Server and Built-in Features

CVE-2026-59229

1. Basic Information

Severity: High
CVSS: 8.8 (v3.1, CISA-ADP)
Title: Legacy Pipe privilege escalation
Published: 2026-10-21
CWE: Not disclosed
Affected component: Server / Legacy Pipe
References: CVE Record · NVD

2. Affected Versions

>= v2.0.0.1, < v2.0.11.1

3. Fixed Versions

v2.0.11.1

4. Vulnerability Summary

The Legacy Pipe receiver uses a fixed superuser identity when handling data loading and deletion operations, bypassing normal data permission checks. Users who already have system privileges such as USE_PIPE and MAINTAIN, but lack write or delete permissions on the target database, may trigger data loading or deletion operations that run as the superuser, resulting in unauthorized data modification.

CVE-2026-59562

1. Basic Information

Severity: Critical
CVSS: 9.8 (v3.1, CISA-ADP)
Title: Unauthenticated path traversal and remote code execution in Legacy Pipe sendFile
Published: 2026-10-21
CWE: CWE-306
Affected component: Server / Legacy Pipe
References: CVE Record · NVD

2. Affected Versions

>= v2.0.0.1, < v2.0.11.1

3. Fixed Versions

v2.0.11.1

4. Vulnerability Summary

The Legacy Pipe sendFile RPC interface lacks authentication for critical functionality. An unauthenticated remote attacker who can access this interface may exploit a path traversal vulnerability, posing a risk of remote code execution. Public information does not disclose the complete exploit chain.

CVE-2026-58663

1. Basic Information

Severity: Critical
CVSS: 9.8 (v3.1, CISA-ADP)
Title: Authentication bypass in the pipeTransfer() interface
Published: 2026-10-21
CWE: Not disclosed
Affected component: Server / Thrift RPC / Pipe
References: CVE Record · NVD

2. Affected Versions

>= v2.0.0.1, < v2.0.11.1

3. Fixed Versions

v2.0.11.1

4. Vulnerability Summary

The pipeTransfer() interface of the Thrift RPC service has an authentication bypass vulnerability. An attacker who can access the relevant RPC service may bypass normal authentication and invoke related Pipe functionality. Refer to the public vulnerability record for the scope of operations that can be performed.

CVE-2026-44630

1. Basic Information

Severity: High
CVSS: 7.5 (v3.1, CISA-ADP)
Title: Memory exhaustion due to unchecked Thrift string lengths
Published: 2026-08-10
CWE: CWE-789, CWE-400
Affected component: Server / RPC
References: CVE Record · NVD

2. Affected Versions

< v1.3.8.1
>= v2.0.0.1, < v2.0.10.1

3. Fixed Versions

v2.0.10.1

4. Vulnerability Summary

When processing Thrift requests, the RPC service does not adequately validate the string length field. An unauthenticated remote attacker who can access the RPC service can use malformed requests to trigger excessive memory allocation, causing an OutOfMemoryError and crashing the service.

CVE-2026-40452

1. Basic Information

Severity: High
CVSS: 7.5 (v3.1, CISA-ADP)
Title: Unauthorized access to latest values through REST fastLastQuery
Published: 2026-07-10
CWE: CWE-863, CWE-284
Affected component: Server / Built-in REST
References: CVE Record · NVD

2. Affected Versions

>= v1.3.5.1, < v1.3.8.1
>= v2.0.5.1, < v2.0.10.1

3. Fixed Versions

v2.0.10.1

4. Vulnerability Summary

The /rest/v2/fastLastQuery interface of the built-in REST service does not correctly enforce data authorization checks. When the REST service is enabled and reachable, an authenticated user without the corresponding data access permissions may read latest-value data without authorization, resulting in information disclosure.

CVE-2026-40009

1. Basic Information

Severity: Medium
CVSS: 6.5 (v3.1, CISA-ADP)
Title: Tree model privilege escalation by renaming a user to the internal auditor
Published: 2026-07-10
CWE: CWE-269, CWE-284
Affected component: Server / User and permission management
References: CVE Record · NVD

2. Affected Versions

>= v2.0.8.1, < v2.0.10.1

3. Fixed Versions

v2.0.10.1

4. Vulnerability Summary

User management has a privilege escalation issue in its handling of the internal auditor identity. An authenticated user who can perform the relevant rename operation may gain full tree-path access by renaming themselves to __internal_auditor, bypassing existing data permission restrictions.

CVE-2026-40008

1. Basic Information

Severity: Critical
CVSS: 9.8 (v3.1, CISA-ADP)
Title: Arbitrary class instantiation in Pipe Transfer RPC
Published: 2026-07-10
CWE: CWE-470
Affected component: Server / Pipe
References: CVE Record · NVD

2. Affected Versions

>= v1.0.0.1, < v2.0.10.1

3. Fixed Versions

v2.0.10.1

4. Vulnerability Summary

Pipe Transfer RPC processing reads a fully qualified Java class name from input and directly instantiates it through reflection, without adequate input validation or an allowlist. When the relevant interface is reachable, an attacker may trigger arbitrary class instantiation. The actual impact depends on the classes that can be loaded and the execution context; this does not establish that remote code execution is possible in every runtime environment.

CVE-2026-40007

1. Basic Information

Severity: High
CVSS: 7.5 (v3.1, CISA-ADP)
Title: Stack overflow due to unbounded recursion in AirGap prefix parsing
Published: 2026-07-10
CWE: CWE-674, CWE-400
Affected component: Server / AirGap Pipe receiver
References: CVE Record · NVD

2. Affected Versions

>= v1.0.0.1, < v2.0.10.1

3. Fixed Versions

v2.0.10.1

4. Vulnerability Summary

When identifying a protocol prefix, the AirGap receiver recursively reads subsequent lengths without limiting recursion depth. When pipe_air_gap_receiver_enabled=true and the receiver is reachable, an unauthenticated attacker may exhaust the JVM stack of a connection-handling thread, triggering a StackOverflowError and affecting connection handling.

CVE-2026-40006

1. Basic Information

Severity: High
CVSS: 7.5 (v3.1, CISA-ADP)
Title: Unauthenticated heap exhaustion through the AirGap length field
Published: 2026-07-10
CWE: CWE-789, CWE-770, CWE-306
Affected component: Server / AirGap Pipe receiver
References: CVE Record · NVD

2. Affected Versions

>= v1.0.0.1, < v2.0.10.1

3. Fixed Versions

v2.0.10.1

4. Vulnerability Summary

The AirGap receiver uses an externally supplied length field directly to allocate a byte array without a reasonable allocation limit. When pipe_air_gap_receiver_enabled=true and the receiver is reachable, an unauthenticated attacker can trigger excessive heap allocation, causing the DataNode to crash or suffer severe performance degradation.

CVE-2026-40005

1. Basic Information

Severity: Critical
CVSS: 9.1 (v3.1, CISA-ADP)
Title: Path traversal in the Pipe file transfer receiver
Published: 2026-07-10
CWE: CWE-22
Affected component: Server / Pipe file transfer
References: CVE Record · NVD

2. Affected Versions

>= v1.0.0.1, < v2.0.10.1

3. Fixed Versions

v2.0.10.1

4. Vulnerability Summary

The Pipe file transfer receiver has a path traversal vulnerability. An attacker may use the relevant file transfer interface to write files outside the intended receiving directory. The actual writable scope is limited by the operating system permissions of the TimechoDB process. Public information does not specify the permissions required by the caller or the conditions for subsequent code execution.

CVE-2026-28564

1. Basic Information

Severity: Critical
CVSS: 9.8 (v3.1, CISA-ADP)
Title: REST Basic Authentication accepts invalidated cached credentials
Published: 2026-07-10
CWE: CWE-613, CWE-294
Affected component: Server / REST authentication
References: CVE Record · NVD

2. Affected Versions

>= v1.0.0.1, < v2.0.10.1

3. Fixed Versions

v2.0.10.1

4. Vulnerability Summary

REST Basic Authentication does not adequately invalidate cached credentials and may continue to accept credentials that are no longer valid. An attacker with the relevant credentials and the required cache state may bypass the expected authentication invalidation mechanism. Public information does not list all triggering conditions.

CVE-2026-24013

1. Basic Information

Severity: Critical
CVSS: 9.1 (v3.1, CISA-ADP)
Title: Thrift RPC authentication bypass through a forged SessionID
Published: 2026-07-06
CWE: CWE-290
Affected component: Server / Thrift RPC queries
References: CVE Record · NVD

2. Affected Versions

>= v1.3.3.1, < v2.0.8.1

3. Fixed Versions

v2.0.8.1

4. Vulnerability Summary

Some Thrift RPC query handlers do not strictly validate sessionId. An attacker who can access the relevant query interfaces may bypass normal session establishment and authentication by forging a session identifier to obtain valid query results, leading to unauthorized access to time-series data.

CVE-2026-24012

1. Basic Information

Severity: High
CVSS: 7.5 (v3.1, CISA-ADP)
Title: Resource exhaustion denial of service through aggregation query parameters
Published: 2026-07-06
CWE: CWE-400
Affected component: Server / Query engine
References: CVE Record · NVD

2. Affected Versions

>= v1.3.3.1, < v2.0.8.1

3. Fixed Versions

v2.0.8.1

4. Vulnerability Summary

Some aggregation query interfaces do not reasonably limit the query time span and aggregation interval. An attacker who can submit the relevant query requests may combine an excessively large time range with an excessively small aggregation interval to trigger the construction of a huge result set, exhausting the Java heap and crashing the DataNode. Public information does not further specify authentication requirements.

CVE-2026-24014

1. Basic Information

Severity: Critical
CVSS: 9.8 (v3.1, CISA-ADP)
Title: Trigger JAR path traversal in DataNode internal RPC
Published: 2026-07-06
CWE: CWE-284, CWE-434
Affected component: Server / DataNode internal RPC
References: CVE Record · NVD

2. Affected Versions

>= v1.3.3.1, < v2.0.8.1

3. Fixed Versions

v2.0.8.1

4. Vulnerability Summary

When creating a Trigger instance, DataNode internal RPC constructs a path using the uploaded JAR file name without adequate validation. If the internal RPC port is exposed to an untrusted network, an attacker may write files outside the Trigger installation directory. The actual writable scope is limited by the operating system permissions of the database process.

CVE-2025-64152

1. Basic Information

Severity: Critical
CVSS: 9.1 (v3.1, CISA-ADP)
Title: Path traversal vulnerability (II)
Published: 2026-06-26
CWE: CWE-22
Affected component: Server / Specific interface not disclosed
References: CVE Record · NVD

2. Affected Versions

>= v1.0.0.1, < v1.3.6.1
>= v2.0.0.1, < v2.0.7.1

3. Fixed Versions

v1.3.6.1
v2.0.7.1

4. Vulnerability Summary

The relevant functionality has a path traversal vulnerability due to insufficient directory restrictions. Public information does not disclose the specific interface, the permissions required to trigger the issue, or whether it involves file reads or writes. This issue is independent of CVE-2025-55017, and the two vulnerabilities have different fixed versions.

CVE-2025-55017

1. Basic Information

Severity: Critical
CVSS: 9.1 (v3.1, CISA-ADP)
Title: Path traversal vulnerability (I)
Published: 2026-06-26
CWE: CWE-22
Affected component: Server / Specific interface not disclosed
References: CVE Record · NVD

2. Affected Versions

>= v1.0.0.1, < v1.3.6.1
>= v2.0.0.1, < v2.0.6.1

3. Fixed Versions

v1.3.6.1
v2.0.6.1

4. Vulnerability Summary

The relevant functionality has a path traversal vulnerability due to insufficient directory restrictions. Public information does not disclose the specific interface, the permissions required to trigger the issue, or whether it involves file reads or writes. Refer to the corresponding vulnerability record for the specific impact.

CVE-2026-24713

1. Basic Information

Severity: Critical
CVSS: 9.8 (v3.1, CISA-ADP)
Title: JEXL expression injection
Published: 2026-03-09
CWE: CWE-20
Affected component: Server / JEXL functionality
References: CVE Record · NVD

2. Affected Versions

>= v1.0.0.1, < v1.3.7.1
>= v2.0.0.1, < v2.0.7.1

3. Fixed Versions

v1.3.7.1
v2.0.7.1

4. Vulnerability Summary

JEXL-related functionality has insufficient input validation, posing a risk of expression injection. Public information does not disclose the specific invocation method, attacker privileges, or full scope of impact. Security hardening in the relevant fixed versions includes removing JEXL functions.

CVE-2026-24015

1. Basic Information

Severity: Critical
CVSS: 9.8 (v3.1, CISA-ADP)
Title: Insecure default listening configuration
Published: 2026-03-09
CWE: CWE-1327
Affected component: Server / Network listening configuration
References: CVE Record · NVD

2. Affected Versions

>= v1.0.0.1, < v1.3.7.1
>= v2.0.0.1, < v2.0.7.1

3. Fixed Versions

v1.3.7.1
v2.0.7.1

4. Vulnerability Summary

The default network listening configuration poses a security risk: services may bind to unrestricted addresses, increasing exposure to untrusted networks. The relevant versions improve security by adjusting the default client RPC listening address and internal service binding behavior.

CVE-2025-48392

1. Basic Information

Severity: High
CVSS: 7.5 (v3.1, CISA-ADP)
Title: Denial-of-service vulnerability
Published: 2025-09-24
CWE: Not disclosed
Affected component: Server / Specific interface not disclosed
References: CVE Record · NVD

2. Affected Versions

>= v1.3.3.1, <= v1.3.4.1
>= v2.0.1.1-beta, <= v2.0.4.1

3. Fixed Versions

v2.0.5.1

4. Vulnerability Summary

The relevant service has a denial-of-service vulnerability that may affect database service availability. Public information does not disclose the specific interface, triggering mechanism, or required permissions.

CVE-2025-48459

1. Basic Information

Severity: Medium
CVSS: 5.3 (v3.1, CISA-ADP)
Title: Deserialization of untrusted data
Published: 2025-09-24
CWE: CWE-502
Affected component: Server / Deserialization
References: CVE Record · NVD

2. Affected Versions

>= v1.0.0.1, < v2.0.5.1

3. Fixed Versions

v2.0.5.1

4. Vulnerability Summary

The relevant functionality has a vulnerability involving deserialization of untrusted data. Processing untrusted serialized data may pose security risks. Public information does not disclose the specific entry point, authentication requirements, or available object chains; the vulnerability type alone does not establish that remote code execution is possible.

CVE-2025-26864

1. Basic Information

Severity: High
CVSS: 7.5 (v3.1, CISA-ADP)
Title: Sensitive information disclosure in OpenID authentication logs
Published: 2025-05-14
CWE: CWE-200, CWE-532
Affected component: Server / OpenIdAuthorizer
References: CVE Record · NVD

2. Affected Versions

>= v0.10.0.1, <= v1.3.3.1
>= v2.0.1.1-beta, < v2.0.2.1

3. Fixed Versions

v1.3.4.1
v2.0.2.1

4. Vulnerability Summary

The server-side OpenIdAuthorizer may write sensitive information to logs when processing OpenID authentication. Unauthorized parties who can access the relevant logs may obtain sensitive information. This issue affects the server-side authentication component and is tracked separately from the JDBC driver logging vulnerability.

CVE-2024-24780

1. Basic Information

Severity: Critical
CVSS: 9.8 (v3.1, CISA-ADP)
Title: Remote code execution through UDF registration from an untrusted URI
Published: 2025-05-14
CWE: Not disclosed
Affected component: Server / UDF
References: CVE Record · NVD

2. Affected Versions

>= v1.0.0.1, < v1.3.4.1

3. Fixed Versions

v1.3.4.1

4. Vulnerability Summary

UDF registration allows users with permission to create UDFs to register functions from untrusted URIs. An attacker may register a malicious function, posing a risk of remote code execution. This issue explicitly requires the attacker to have permission to create UDFs.

CVE-2023-46226

1. Basic Information

Severity: Critical
CVSS: 9.8 (v3.1, CISA-ADP)
Title: Remote code execution risk in UDFs
Published: 2024-01-15
CWE: Not disclosed
Affected component: Server / UDF
References: CVE Record · NVD

2. Affected Versions

>= v1.0.0.1, <= v1.2.2.1

3. Fixed Versions

v1.3.0.1

4. Vulnerability Summary

UDF functionality poses a risk of remote code execution. Public information does not further disclose the specific entry point, required permissions, or complete exploitation conditions.

CVE-2023-51656

1. Basic Information

Severity: Critical
CVSS: 9.8 (v3.1, NVD)
Title: Insecure deserialization in Sync Tool
Published: 2023-12-21
CWE: CWE-502
Affected component: Built-in synchronization tool bundled with the server / Sync Tool
References: CVE Record · NVD

2. Affected Versions

>= v0.13.0.1, <= v0.13.4.1

3. Fixed Versions

v1.2.2.1

4. Vulnerability Summary

The built-in Sync Tool involves deserialization of untrusted data when processing map data, posing a security risk. Only the explicitly listed versions are affected; the fixed version is the upgrade target for this issue.

CVE-2022-43766

1. Basic Information

Severity: High
CVSS: 7.5 (v3.1, CISA-ADP)
Title: Regular expression denial of service in REGEXP on Java 8
Published: 2022-10-26
CWE: Not disclosed
Affected component: Server / REGEXP queries
References: CVE Record · NVD

2. Affected Versions

>= v0.12.2.1, <= v0.12.6.1
>= v0.13.0.1, <= v0.13.2.1

3. Fixed Versions

v0.13.3.1

4. Vulnerability Summary

Processing untrusted REGEXP query patterns in a Java 8 environment may trigger a regular expression denial of service, affecting service availability. In addition to upgrading the database version, consider using a newer Java version after evaluating compatibility with the runtime environment.

CVE-2022-38369

1. Basic Information

Severity: High
CVSS: 8.8 (v3.1, NVD)
Title: Session ID-based login validation vulnerability
Published: 2022-09-05
CWE: Not disclosed
Affected component: Server / Session and login validation
References: CVE Record · NVD

2. Affected Versions

v0.13.0.1

3. Fixed Versions

v0.13.1.1

4. Vulnerability Summary

Session login validation has a security issue. An attacker may exploit Session ID-related flaws to undermine authentication. Public information does not disclose the complete attack procedure.

CVE-2020-1952

1. Basic Information

Severity: Critical
CVSS: 9.8 (v3.1, NVD)
Title: Remote code execution through exposed JMX
Published: 2020-04-27
CWE: Not disclosed
Affected component: Server / JMX
References: CVE Record · NVD

2. Affected Versions

>= v0.8.0.1, <= v0.8.2.1
>= v0.9.0.1, <= v0.9.1.1

3. Fixed Versions

v0.9.2.1

4. Vulnerability Summary

After startup, the service exposes a JMX management port without authentication protection. A remote attacker who can access this port may execute code through JMX. The risk depends on the network reachability of the management port.

3. Clients

CVE-2026-41114

1. Basic Information

Severity: High
CVSS: 7.5 (v3.1, CISA-ADP)
Title: Excessive memory consumption when converting JDBC BigDecimal values to strings
Published: 2026-10-21
CWE: CWE-400
Affected component: Client / JDBC driver
References: CVE Record · NVD

2. Affected Versions

>= v1.3.3.1, < v2.0.11.1

3. Fixed Versions

v2.0.11.1

4. Vulnerability Summary

The JDBC driver has uncontrolled resource consumption in processing related to BigDecimal.toPlainString(). Specific inputs may trigger large memory allocations, causing memory exhaustion in client applications that use the driver. Remediation requires upgrading the JDBC driver actually used by the application.

CVE-2026-40454

1. Basic Information

Severity: High
CVSS: 7.5 (v3.1, CISA-ADP)
Title: Out-of-bounds read in C++ client TsBlock deserialization
Published: 2026-07-10
CWE: CWE-125, CWE-20
Affected component: Client / C++ client-cpp
References: CVE Record · NVD

2. Affected Versions

>= v1.3.5.1, < v1.3.8.1
>= v2.0.5.1, < v2.0.10.1

3. Fixed Versions

v2.0.10.1

4. Vulnerability Summary

The C++ client lacks adequate bounds checking when deserializing TsBlock data returned by the server. Receiving malformed data may trigger an out-of-bounds read and crash the client process. This issue affects the client process, and remediation requires updating the C++ client.

CVE-2025-26795

1. Basic Information

Severity: High
CVSS: 7.5 (v3.1, CISA-ADP)
Title: Sensitive information disclosure in JDBC logs
Published: 2025-05-14
CWE: CWE-200, CWE-532
Affected component: Client / JDBC driver
References: CVE Record · NVD

2. Affected Versions

>= v0.10.0.1, <= v1.3.3.1
>= v2.0.1.1-beta, < v2.0.2.1

3. Fixed Versions

v1.3.4.1
v2.0.2.1

4. Vulnerability Summary

The JDBC driver may write sensitive information to application logs, allowing unauthorized parties who can access those logs to obtain the information. Upgrade the JDBC driver actually used by the application and review log access permissions.

Upgrade the JDBC driver and C++ client separately. Upgrading the server does not automatically update client dependencies in applications. The listed fixed versions apply only to the corresponding vulnerabilities.