Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Apache IoTDB legacy pipe flaws disclosed as important

1 source · 4 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Three important Apache IoTDB legacy-pipe flaws were posted October 21; only one has a stated affected range.

On October 21, Haonan Hou posted three Apache IoTDB advisories to oss-security covering the legacy pipe interfaces. CVE-2026-58663 is an authentication bypass in pipeTransfer(), rated important, with no affected or fixed versions or exploitation status in the notice. CVE-2026-59229, also rated important, affects Apache IoTDB 2.0.0 before 2.0.11: the legacy pipe receiver uses a hardcoded SUPER_USER (root) identity, so a user with only SYSTEM privileges such as USE_PIPE or MAINTAIN can send crafted PipeData for load and delete operations. CVE-2026-59562 describes remote code execution and unauthenticated path traversal in the legacy pipe sendFile RPC, rated important, again without versions or a fix. None of the notices report confirmed exploitation.

Key facts
  • CVE-2026-59229 affects Apache IoTDB 2.0.0 before 2.0.11.
  • Hardcoded identity is SUPER_USER (root) on the legacy pipe receiver.
  • USE_PIPE or MAINTAIN can send crafted PipeData without write or delete rights.
  • CVE-2026-58663 is an auth bypass in pipeTransfer(), rated important.
  • CVE-2026-59562 is RCE and unauthenticated path traversal in sendFile RPC.
  • Notices omit fixes for CVE-2026-58663 and CVE-2026-59562 and any exploitation status.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 21, 2026Auth bypass in pipeTransfer() posted as important. · oss-security
  2. Oct 21, 2026Legacy pipe privilege escalation disclosed for 2.0.0 before 2.0.11. · oss-security
  3. Oct 21, 2026sendFile RPC RCE and path traversal posted as important. · oss-security

What each outlet adds

beyond the shared facts
  • oss-securityThree same-day legacy-pipe advisories, with versions only for CVE-2026-59229.
CVEs
CVE-2026-59562CVE-2026-58663CVE-2026-59229CVE-2026-41114
Vendors
Apache
Products
IoTDBApache IoTDBApache IoTDB JDBC driver

Coverage

oldest first · one row per article · UTC
  1. · 9d ago oss-securityFirst report

    IoTDB JDBC driver memory exhaustion fixed in 2.0.11 (CVE-2026-41114)

    Versions from 1.3.3 before 2.0.11 can exhaust memory via BigDecimal toPlainString.

  2. · 9d ago oss-security

    Apache IoTDB pipeTransfer() auth bypass disclosed (CVE-2026-58663)

    The oss-security note rates the flaw important and does not list versions or a fix.

  3. · 9d ago oss-security

    Apache IoTDB legacy pipe lets SYSTEM users act as root (CVE-2026-59229)

    Versions 2.0.0 before 2.0.11 run load and delete operations with a hardcoded root identity.

  4. · 9d ago oss-security

    Apache IoTDB legacy sendFile RPC allows unauthenticated RCE (CVE-2026-59562)

    Apache rates the legacy pipe sendFile flaw important; the notice gives no versions or fix.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-41114
Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver
7.5—
CVE-2026-58663
An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB
9.8—
CVE-2026-59229
The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing data loading and deletion operations
8.8—
CVE-2026-59562
Missing authentication for critical function vulnerability in Apache IoTDB
9.8—