Apache IoTDB pipeTransfer() auth bypass disclosed (CVE-2026-58663)
Original title: CVE-2026-58663: Apache IoTDB: Auth Bypass in pipeTransfer() interface
The oss-security note rates the flaw important and does not list versions or a fix.
Haonan Hou posted CVE-2026-58663 to oss-security on October 21, describing an authentication bypass in Apache IoTDB’s pipeTransfer() interface. The snippet rates severity as important and points to the Apache IoTDB site. Affected versions, a fixed release, and exploitation status are not in the text.
Unconfirmed: Affected versions, a fix, and whether it is exploited are not stated in the snippet.
- Posted by Haonan Hou on October 21.
- Severity is listed as important.
- The interface named is pipeTransfer().
- No affected or fixed versions appear in the snippet.
Impact: Authentication bypass in the pipeTransfer() interface
| Product | Affected |
|---|---|
| Apache IoTDB | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58663 | An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB | 9.8 | — |
From the original article
Posted by Haonan Hou on Oct 21 Severity: important https://www. linkedin. com/in/anurag-kumar-8413a0197) (analyst) https://iotdb.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.