CVE-2026-58663: Apache IoTDB: Auth Bypass in pipeTransfer() interface

Q: Which deployments are affected?

Apache IoTDB versions from 2.0.0 up to, but not including, 2.0.11 are affected. The issue is in the Thrift RPC service's pipeTransfer() interface.

Q: What does an attacker need to exploit this issue?

The vulnerability is an authentication bypass in the pipeTransfer() interface. The provided information does not state any additional attacker prerequisites, such as required network position or credentials.

Q: What should operators do to remediate the issue?

Upgrade Apache IoTDB to version 2.0.11, which fixes the authentication bypass.

Published Oct 21, 2026

Updated

An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service

This issue affects Apache IoTDB: from 2.0.0 before 2.0.11.

Users are recommended to upgrade to version 2.0.11, which fixes the issue.

Affected Software

1 affected component

Apache IoTDB>=2.0.0<2.0.11

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache IoTDB to a version that resolves this vulnerability.
Fixed in 2.0.11

Event History

Oct 21, 2026

CVE Published

via MITRE·11:03 AM

Data Sourced

via MITRE·11:03 AM

DescriptionWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Apache IoTDB versions from 2.0.0 up to, but not including, 2.0.11 are affected. The issue is in the Thrift RPC service's pipeTransfer() interface.

What does an attacker need to exploit this issue?