Live › vulnerability › CVE-2026-59229
Go to dashboardThe Legacy Pipe receiver in Apache IoTDB runs data loading and deletion operations under a hardcoded root identity. A user holding only SYSTEM-level privileges such as USE_PIPE or MAINTAIN can send crafted PipeData messages and read or change data they have no write or delete permission on.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Apache IoTDB from 2.0.0 before 2.0.11 that accept Legacy Pipe data over the receiver protocol. Exposure depends on users who hold SYSTEM-level privileges such as USE_PIPE or MAINTAIN, since those are the accounts that can reach the flawed path. Deployments on 2.0.11 or later, or with no Legacy Pipe receiver in use, can skip it.
No product ranges from the sources yet.
cat IOTDB_HOME/lib/*.jar or the server startup banner; affected versions are 2.0.0 up to but not including 2.0.11USE_PIPE or MAINTAIN with the Legacy Pipe receiver enabled2.0.11 or later, which fixes the issueUSE_PIPE or MAINTAIN and remove them where not neededEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges (such as USE_PIPE or MAINTAIN) who does NOT have WRITE_DATA or DELETE_DATA permissions on target databases can send specially crafted PipeData messages through the Legacy Pipe API, resulting in data loading/deletion operations executed as root — effectively bypassing IoTDB's permission model entirely.
This issue affects Apache IoTDB: from 2.0.0 before 2.0.11.
Users are recommended to upgrade to version 2.0.11, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-59229")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.