SB2026102313 - Multiple vulnerabilities in Apache IoTDB

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102313

SB2026102313 - Multiple vulnerabilities in Apache IoTDB

Published: October 23, 2026

Security Bulletin ID SB2026102313
CSH Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Improper Authentication (CVE-ID: CVE-2026-58663)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication and potentially gain unauthorized access to protected RPC functionality.

The vulnerability exists due to improper authentication in the pipeTransfer() interface of Apache IoTDB's Thrift RPC service when handling RPC requests. A remote attacker can send requests to this interface to bypass authentication and potentially access functionality that should require authentication.


2) Path traversal (CVE-ID: CVE-2026-59562)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code and perform path traversal.

The vulnerability exists due to path traversal and missing authentication for a critical function in the legacy pipe sendFile RPC when handling file-transfer requests. A remote attacker can submit crafted requests without authentication to access paths outside the intended directory and execute arbitrary code.


3) Incorrect authorization (CVE-ID: CVE-2026-59229)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass database permissions and perform unauthorized data loading and deletion operations as root.

The vulnerability exists due to improper authorization in the Apache IoTDB Legacy Pipe receiver protocol (handshake / sendPipeData) when executing data loading and deletion operations using a hardcoded SUPER_USER (root) identity. A remote user can send specially crafted PipeData messages through the Legacy Pipe API with only SYSTEM-level privileges, such as USE_PIPE or MAINTAIN, to load or delete data without WRITE_DATA or DELETE_DATA permissions on the target databases.


Remediation

Install update from vendor's website.

References