Apache IoTDB: Privilege escalation in Legacy Pipe protocol (CVE-2026-59229)
Apache IoTDB versions 2.0.0 through 2.0.10 contain a privilege escalation vulnerability where the Legacy Pipe receiver protocol uses a hardcoded root identity to perform unauthorized data operations.
CVE search metadata
CVE search record: CVE-2026-59229. KEV: no. Product: IoTDB (< 2.0.11). Brief: Apache IoTDB: Privilege escalation in Legacy Pipe protocol (CVE-2026-59229). Brief link: https://feed.craftedsignal.io/briefs/2026-10-apache-iotdb-privilege-escalation/
Triage facts
Revision 1- Applicability
- IoTDB (< 2.0.11)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 21, 17:06 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Apache IoTDB versions 2.0.0 through 2.0.10 are vulnerable to a privilege escalation flaw in the Legacy Pipe receiver protocol (CVE-2026-59229). The vulnerability stems from the protocol using a hardcoded SUPER_USER (root) identity when executing data loading and deletion operations. An authenticated attacker possessing only system-level privileges (such as USE_PIPE or MAINTAIN) can bypass authorization checks to perform WRITE_DATA or DELETE_DATA operations on unauthorized databases by sending specially crafted PipeData messages.
Impact
Successful exploitation allows authenticated users with restricted system-level permissions to perform data modification or deletion tasks that they are otherwise unauthorized to execute.
Recommendation
Upgrade Apache IoTDB to version 2.0.11 or later to resolve the hardcoded credential usage in the Legacy Pipe receiver protocol.
Mitigations
Upgrade Apache IoTDB to version 2.0.11 or later
CVE-2026-59229