Live › vulnerability › CVE-2026-59562
Go to dashboardApache IoTDB versions 2.0.0 through 2.0.10 expose a critical function without requiring authentication. An attacker who can reach the server over the network can invoke that function without credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Apache IoTDB 2.0.0 through 2.0.10 that expose its service ports to networks beyond trusted hosts are exposed. Deployments limited to a locked-down internal network with strict access control carry less risk, but the sources do not specify which function is involved, so exposure beyond that is unknown.
No product ranges from the sources yet.
sbin/start-confignode.sh -v or the version in the server log header2.0.0 to 2.0.102.0.11Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing authentication for critical function vulnerability in Apache IoTDB.
This issue affects Apache IoTDB: from 2.0.0 before 2.0.11.
Users are recommended to upgrade to version 2.0.11, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-59562")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.