Read the docs
TI-2026-78555 Aliases CVE-2026-59229GHSA-6m49-362q-wcpg

Privilege escalation in Apache IoTDB Legacy Pipe receiver

Priority MEDIUM 40CWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-798.

Summary

Apache IoTDB from 2.0.0 before 2.0.11 runs data loading and deletion in its Legacy Pipe receiver as a hardcoded root identity (CWE-798). A user with only system level privileges such as USE_PIPE or MAINTAIN, but without write or delete rights on target databases, can send crafted PipeData messages and bypass the database permission model. An authenticated remote attacker with low privileges can therefore load or delete data they are not permitted to change.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges (such as USE_PIPE or MAINTAIN) who does NOT have WRITE_DATA or DELETE_DATA permissions on target databases can send specially crafted PipeData messages through the Legacy Pipe API, resulting in data loading/deletion operations executed as root — effectively bypassing IoTDB's permission model entirely. This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are recommended to upgrade to version 2.0.11, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00449 39th percentileScored 2026-11-07
Fix Fixed Apache IoTDB (Apache Software Foundation): 2.0.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache IoTDB2.0.0 to before 2.0.112.0.11Patch availableCNA
  • Apache IoTDB VendorApache Affected 2.0.0 to before 2.0.11 Fixed in 2.0.11 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*——Apache
  • cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:* Versions — — ·Apache

Remediation

Upgrade Apache IoTDB to version 2.0.11, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA Apache IoTDB (Apache Software Foundation) Fixed in 2.0.11

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache IoTDB 2.0.11

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-78556 Missing authentication in Apache IoTDB legacy pipe sendFile RPCPriority MEDIUM 50
    • TI-2026-78554 Authentication bypass in Apache IoTDB pipeTransfer interfacePriority MEDIUM 50
    Show all 3 records →

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-59229
  2. 2026-10-21 Alias added: GHSA-6m49-362q-wcpg
  3. 2026-10-30 CVSS score added · CISA ADP
  4. 2026-10-30 Weakness changed · CISA ADP
  5. 2026-10-30 CISA SSVC decision points changed
  6. 2026-10-30 Priority changed: LOW → MEDIUM

References

Advisory 1

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
See all 4053 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences