{"id":"CVE-2026-59229","kind":"vulnerability","aliases":["CVE-2026-59229"],"related":[],"title":"Apache IoTDB: Legacy Pipe receiver runs data loads and deletes as root","description":"The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a\nhardcoded SUPER_USER (root) identity when executing data loading and\ndeletion operations. A user with only SYSTEM-level privileges (such as\nUSE_PIPE or MAINTAIN) who does NOT have WRITE_DATA or DELETE_DATA\npermissions on target databases can send specially crafted PipeData\nmessages through the Legacy Pipe API, resulting in data loading/deletion\noperations executed as root — effectively bypassing IoTDB's permission\nmodel entirely.\n\n\n\nThis issue affects Apache IoTDB: from 2.0.0 before 2.0.11.\n\n\n\nUsers are recommended to upgrade to version 2.0.11, which fixes the issue.","summary":"The Legacy Pipe receiver in Apache IoTDB runs data loading and deletion operations under a hardcoded root identity. A user holding only SYSTEM-level privileges such as USE_PIPE or MAINTAIN can send crafted PipeData messages and read or change data they have no write or delete permission on.","severity":"high","cvss":null,"epss":0.00255,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-iotdb","package","self-hosted","time-series-database"],"not_affected_if":["no-legacy-pipe-receiver","version-2.0.11-or-later"],"how_to_check":"- Check the installed IoTDB version, for example `cat IOTDB_HOME/lib/*.jar` or the server startup banner; affected versions are `2.0.0` up to but not including `2.0.11`\n- Look for users granted `USE_PIPE` or `MAINTAIN` with the Legacy Pipe receiver enabled","fix":"- Upgrade Apache IoTDB to `2.0.11` or later, which fixes the issue\n- Review which accounts hold `USE_PIPE` or `MAINTAIN` and remove them where not needed","status":"open","published_at":"2026-10-21T12:17:21+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:48+00:00","updated_at":"2026-10-25T05:02:48+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T05:02:48Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache IoTDB to `2.0.11` or later, which fixes the issue\n- Review which accounts hold `USE_PIPE` or `MAINTAIN` and remove them where not needed","reach":"network","title":"Apache IoTDB: Legacy Pipe receiver runs data loads and deletes as root","impact":"high","summary":"The Legacy Pipe receiver in Apache IoTDB runs data loading and deletion operations under a hardcoded root identity. A user holding only SYSTEM-level privileges such as USE_PIPE or MAINTAIN can send crafted PipeData messages and read or change data they have no write or delete permission on.","category":"package","nicknames":[],"who_cares":["apache-iotdb","time-series-database","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Low-privileged user reads or deletes data as root, bypassing permissions","analyst_note":"","how_to_check":"- Check the installed IoTDB version, for example `cat IOTDB_HOME/lib/*.jar` or the server startup banner; affected versions are `2.0.0` up to but not including `2.0.11`\n- Look for users granted `USE_PIPE` or `MAINTAIN` with the Legacy Pipe receiver enabled","needs_analyst":false,"not_affected_if":["version-2.0.11-or-later","no-legacy-pipe-receiver"],"who_is_affected":"Teams running Apache IoTDB from 2.0.0 before 2.0.11 that accept Legacy Pipe data over the receiver protocol. Exposure depends on users who hold SYSTEM-level privileges such as USE_PIPE or MAINTAIN, since those are the accounts that can reach the flawed path. Deployments on 2.0.11 or later, or with no Legacy Pipe receiver in use, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":3515,"output_tokens":685,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-59229':15A,18A '2.0.0':159C '2.0.11':161C,169C 'affect':155C 'apach':1A,20B,35B,156C 'apache-iotdb':19B 'api':137C 'bypass':147C 'chang':70B 'craft':64B,130C 'cve':13A,16A 'data':7A,38B,71B,95C,119C,122C,140C 'databas':29B,126C 'delet':10A,41B,77B,98C,121C 'effect':146C 'entir':152C 'execut':94C,143C 'fix':171C 'handshak':84C 'hardcod':45B,88C 'hold':50B 'host':25B 'ident':47B,92C 'iotdb':2A,21B,36B,148C,157C 'issu':154C,173C 'legaci':3A,31B,80C,135C 'level':54B,106C 'load':8A,39B,96C 'loading/deletion':141C 'maintain':61B,113C 'messag':66B,132C 'model':151C 'oper':42B,99C,142C 'packag':22B 'permiss':78B,123C,150C 'pipe':4A,32B,59B,81C,111C,136C 'pipedata':65B,131C 'privileg':55B,107C 'protocol':83C 'read':68B 'receiv':5A,33B,82C 'recommend':164C 'result':138C 'root':12A,46B,91C,145C 'run':6A,37B 'self':24B 'self-host':23B 'send':63B,128C 'sendpipedata':85C 'seri':28B 'special':129C 'super':89C 'system':53B,105C 'system-level':52B,104C 'target':125C 'time':27B 'time-series-databas':26B 'upgrad':166C 'use':58B,86C,110C 'user':49B,90C,101C,162C 'version':168C 'write':75B,118C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache IoTDB from 2.0.0 before 2.0.11 that accept Legacy Pipe data over the receiver protocol. Exposure depends on users who hold SYSTEM-level privileges such as USE_PIPE or MAINTAIN, since those are the accounts that can reach the flawed path. Deployments on 2.0.11 or later, or with no Legacy Pipe receiver in use, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T12:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59229","severity":null,"published_at":"2026-10-21T12:17:21+00:00","modified_at":"2026-10-22T16:56:52+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-59229","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-59229","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}