Live › vulnerability › CVE-2026-58663
Go to dashboardApache IoTDB's Thrift RPC service has an authentication bypass affecting releases from 2.0.0 before 2.0.11. The sources do not describe what an attacker can do after bypassing authentication.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Apache IoTDB 2.0.0 through 2.0.10 that expose the Thrift RPC service. The sources do not say whether the default configuration is exposed or which network paths reach the service.
No product ranges from the sources yet.
SHOW VERSION in the IoTDB CLI or check the server package version and confirm whether it is between 2.0.0 and 2.0.102.0.11, which the advisory says fixes the issueEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service
This issue affects Apache IoTDB: from 2.0.0 before 2.0.11.
Users are recommended to upgrade to version 2.0.11, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-58663")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.