{"id":"CVE-2026-58663","kind":"vulnerability","aliases":["CVE-2026-58663"],"related":[],"title":"Apache IoTDB: Thrift RPC authentication bypass in versions 2.0.0 to 2.0.10","description":"An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service\n\n\n\nThis issue affects Apache IoTDB: from 2.0.0 before 2.0.11.\n\n\n\nUsers are recommended to upgrade to version 2.0.11, which fixes the issue.","summary":"Apache IoTDB's Thrift RPC service has an authentication bypass affecting releases from 2.0.0 before 2.0.11. The sources do not describe what an attacker can do after bypassing authentication.","severity":"unknown","cvss":null,"epss":0.00276,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-iotdb","package","self-hosted","time-series-database"],"not_affected_if":["version-2.0.11-or-later"],"how_to_check":"- Run `SHOW VERSION` in the IoTDB CLI or check the server package version and confirm whether it is between `2.0.0` and `2.0.10`\n- unknown whether any other check applies","fix":"- Upgrade Apache IoTDB to `2.0.11`, which the advisory says fixes the issue","status":"open","published_at":"2026-10-21T11:17:07+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:55+00:00","updated_at":"2026-10-25T05:02:55+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T05:02:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache IoTDB to `2.0.11`, which the advisory says fixes the issue","reach":"network","title":"Apache IoTDB: Thrift RPC authentication bypass in versions 2.0.0 to 2.0.10","impact":"high","summary":"Apache IoTDB's Thrift RPC service has an authentication bypass affecting releases from 2.0.0 before 2.0.11. The sources do not describe what an attacker can do after bypassing authentication.","category":"package","nicknames":[],"who_cares":["apache-iotdb","time-series-database","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown access to the IoTDB server through the RPC service","analyst_note":"Confirm from the Apache IoTDB advisory what an attacker gains after bypassing authentication and whether the default config exposes Thrift RPC.","how_to_check":"- Run `SHOW VERSION` in the IoTDB CLI or check the server package version and confirm whether it is between `2.0.0` and `2.0.10`\n- unknown whether any other check applies","needs_analyst":true,"not_affected_if":["version-2.0.11-or-later"],"who_is_affected":"Teams running Apache IoTDB 2.0.0 through 2.0.10 that expose the Thrift RPC service. The sources do not say whether the default configuration is exposed or which network paths reach the service.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000602,"input_tokens":3351,"output_tokens":534,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-58663':14A,17A '2.0.0':9A,42B,76C '2.0.10':11A '2.0.11':44B,78C,86C 'affect':39B,72C 'apach':1A,19B,29B,64C,73C 'apache-iotdb':18B 'attack':52B 'authent':5A,37B,57B,59C 'bypass':6A,38B,56B,60C 'cve':12A,15A 'databas':28B 'describ':49B 'exist':62C 'fix':88C 'host':24B 'iotdb':2A,20B,30B,65C,74C 'issu':71C,90C 'packag':21B 'recommend':81C 'releas':40B 'rpc':4A,33B,68C 'self':23B 'self-host':22B 'seri':27B 'servic':34B,69C 'sourc':46B 'thrift':3A,32B,67C 'time':26B 'time-series-databas':25B 'upgrad':83C 'user':79C 'version':8A,85C 'vulner':61C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache IoTDB 2.0.0 through 2.0.10 that expose the Thrift RPC service. The sources do not say whether the default configuration is exposed or which network paths reach the service.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T11:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58663","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58663","severity":null,"published_at":"2026-10-21T11:17:07+00:00","modified_at":"2026-10-22T16:56:52+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-58663","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-58663","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}