CVE-2026-59562: Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC
Published Oct 21, 2026
·Updated
Missing authentication for critical function vulnerability in Apache IoTDB.
This issue affects Apache IoTDB: from 2.0.0 before 2.0.11.
Users are recommended to upgrade to version 2.0.11, which fixes the issue.
Affected Software
1 affected component
Apache IoTDB>=2.0.0<2.0.11
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache IoTDBto a version that resolves this vulnerability.Fixed in 2.0.11
Event History
Oct 21, 2026
CVE Published
via MITRE·11:10 AM
Data Sourced
via MITRE·11:10 AM
DescriptionWeakness
Data Sourced
via NVD·12:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Apache IoTDB versions from 2.0.0 before 2.0.11 are affected.
2
Does exploiting this issue require authentication?
No. The issue is described as missing authentication for a critical function, so the affected legacy pipe sendFile RPC can be reached without authentication.
3
What is the recommended remediation?
Upgrade Apache IoTDB to version 2.0.11, which fixes the issue.