Apache IoTDB legacy pipe lets SYSTEM users act as root (CVE-2026-59229)
Original title: CVE-2026-59229: Apache IoTDB: Legacy Pipe Privilege Escalation
Versions 2.0.0 before 2.0.11 run load and delete operations with a hardcoded root identity.
Haonan Hou reported CVE-2026-59229 in Apache IoTDB on October 21, rated important. The legacy pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity for data loading and deletion. A user with only SYSTEM-level privileges such as USE_PIPE or MAINTAIN, and without WRITE_DATA or DELETE_DATA on target databases, can send crafted PipeData messages. Affected versions are Apache IoTDB 2.0.0 before 2.0.11.
Unconfirmed: The excerpt does not state a fixed release or whether the flaw is exploited.
- Affected range is Apache IoTDB 2.0.0 before 2.0.11.
- Hardcoded identity is SUPER_USER (root).
- Relevant privileges named include USE_PIPE and MAINTAIN.
- The excerpt cuts off during the attack description.
Impact: Write or delete data as hardcoded root
| Product | Affected |
|---|---|
| Apache IoTDB | 2.0.0 before 2.0.11 |
- CVEs
- CVE-2026-59229
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-59229 | The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing data loading and deletion operations | 8.8 | — |
From the original article
Posted by Haonan Hou on Oct 21 Severity: important Affected versions: - Apache IoTDB 2. 0. 0 before 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.