Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

Apache IoTDB legacy sendFile RPC allows unauthenticated RCE (CVE-2026-59562)

Original title: CVE-2026-59562: Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC

oss-security ()1
Read at seclists.org
Part of a story covered by 4 sourcesApache IoTDB legacy pipe flaws disclosed as importantMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Apache rates the legacy pipe sendFile flaw important; the notice gives no versions or fix.

Haonan Hou posted CVE-2026-59562 to oss-security on October 21. Apache IoTDB’s legacy pipe sendFile RPC is described as allowing remote code execution and unauthenticated path traversal. The feed excerpt gives severity “important” and links to the Apache IoTDB site and the CVE record, but no affected or fixed versions.

Unconfirmed: The excerpt does not state affected versions, a fix, or exploitation.

Key facts
  • Posted by Haonan Hou on October 21.
  • Apache severity rating is important.
  • Issue is in the legacy pipe sendFile RPC.
Security assessment · AI, from the article

Impact: Remote code execution and unauthenticated path traversal

ProductAffected
Apache IoTDB—
Analyze CVE-2026-59562 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-59562
ATT&CK
T1190 Exploit Public-Facing Application
Tags
apache-iotdbpath-traversalrcerpc
Vendors
Apache
Products
IoTDB

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-59562
Missing authentication for critical function vulnerability in Apache IoTDB
9.8—

From the original article

Posted by Haonan Hou on Oct 21 Severity: important https://iotdb. apache. org https://www.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.