You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@iotdb.apache.org by Haonan Hou <ha...@apache.org> on 2026/10/21 10:38:44 UTC

CVE-2026-58663: Apache IoTDB: Auth Bypass in pipeTransfer() interface

Severity: important 

Affected versions:

- Apache IoTDB 2.0.0 before 2.0.11

Description:

An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service



This issue affects Apache IoTDB: from 2.0.0 before 2.0.11.



Users are recommended to upgrade to version 2.0.11, which fixes the issue.

Credit:

Anurag Kumar (https://www.linkedin.com/in/anurag-kumar-8413a0197) (analyst)

References:

https://iotdb.apache.org
https://www.cve.org/CVERecord?id=CVE-2026-58663