---
id: "CVE-2026-58663"
kind: "vulnerability"
aliases: ["CVE-2026-58663"]
title: "Apache IoTDB: Thrift RPC authentication bypass in versions 2.0.0 to 2.0.10"
severity: "unknown"
cvss: null
epss: 0.00276
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-iotdb", "package", "self-hosted", "time-series-database"]
not_affected_if: ["version-2.0.11-or-later"]
published_at: "2026-10-21T11:17:07+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T05:02:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58663", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-58663", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Apache IoTDB: Thrift RPC authentication bypass in versions 2.0.0 to 2.0.10

Apache IoTDB's Thrift RPC service has an authentication bypass affecting releases from 2.0.0 before 2.0.11. The sources do not describe what an attacker can do after bypassing authentication.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `SHOW VERSION` in the IoTDB CLI or check the server package version and confirm whether it is between `2.0.0` and `2.0.10`
- unknown whether any other check applies

## Fix

- Upgrade Apache IoTDB to `2.0.11`, which the advisory says fixes the issue

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-58663
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-58663

## From the sources

An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service



This issue affects Apache IoTDB: from 2.0.0 before 2.0.11.



Users are recommended to upgrade to version 2.0.11, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_