Incorrect authorization in Apache IoTDB - CVE-2026-59229
Published: October 23, 2026
Vulnerability identifier: #VU157373
CSH Severity: Medium
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59229
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass database permissions and perform unauthorized data loading and deletion operations as root.
The vulnerability exists due to improper authorization in the Apache IoTDB Legacy Pipe receiver protocol (handshake / sendPipeData) when executing data loading and deletion operations using a hardcoded SUPER_USER (root) identity. A remote user can send specially crafted PipeData messages through the Legacy Pipe API with only SYSTEM-level privileges, such as USE_PIPE or MAINTAIN, to load or delete data without WRITE_DATA or DELETE_DATA permissions on the target databases.
Affected software
Apache IoTDB
How to mitigate CVE-2026-59229
Install security update from vendor's website.
Apache IoTDB - update to 2.0.11