CVE-2026-59229: Apache IoTDB: Legacy Pipe Privilege Escalation
The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPERUSER (root) identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges (such as USEPIPE or MAINTAIN) who does NOT have WRITEDATA or DELETEDATA permissions on target databases can send specially crafted PipeData messages through the Legacy Pipe API, resulting in data loading/deletion operations executed as root — effectively bypassing IoTDB's permission model entirely.
This issue affects Apache IoTDB: from 2.0.0 before 2.0.11.
Users are recommended to upgrade to version 2.0.11, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache IoTDBto a version that resolves this vulnerability.Fixed in 2.0.11
Event History
Frequently Asked Questions
Which deployments are affected?
Apache IoTDB versions from 2.0.0 before 2.0.11 are affected where the Legacy Pipe receiver protocol is available. The issue concerns operations submitted through the Legacy Pipe API, including its handshake and sendPipeData paths.
What access does an attacker need?
An attacker needs SYSTEM-level privileges, such as USE_PIPE or MAINTAIN, and the ability to send specially crafted PipeData messages through the Legacy Pipe API. They do not need WRITE_DATA or DELETE_DATA permissions on the target databases.
What can successful exploitation allow?
Specially crafted PipeData can cause data loading or deletion operations to execute under the hardcoded root identity. This bypasses the normal IoTDB permission checks for the target databases.
How should affected users remediate this issue?
Upgrade Apache IoTDB to version 2.0.11, which fixes the issue.