{"id":"CVE-2026-59562","kind":"vulnerability","aliases":["CVE-2026-59562"],"related":[],"title":"Apache IoTDB: missing authentication lets unauthenticated users reach a critical function","description":"Missing authentication for critical function vulnerability in Apache IoTDB.\n\n\n\nThis issue affects Apache IoTDB: from 2.0.0 before 2.0.11.\n\n\n\nUsers are recommended to upgrade to version 2.0.11, which fixes the issue.","summary":"Apache IoTDB versions 2.0.0 through 2.0.10 expose a critical function without requiring authentication. An attacker who can reach the server over the network can invoke that function without credentials.","severity":"unknown","cvss":null,"epss":0.00283,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-iotdb","database","iot","package","self-hosted"],"not_affected_if":["isolated-network","version-2.0.11-or-later"],"how_to_check":"- Check the installed IoTDB version with `sbin/start-confignode.sh -v` or the version in the server log header\n- Confirm the version is in the affected range `2.0.0` to `2.0.10`\n- unknown which specific function is exposed; the sources do not say","fix":"- Upgrade Apache IoTDB to `2.0.11`\n- Restrict network access to the IoTDB ports until the upgrade is applied","status":"open","published_at":"2026-10-21T12:17:22+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:47+00:00","updated_at":"2026-10-25T05:02:47+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:02:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache IoTDB to `2.0.11`\n- Restrict network access to the IoTDB ports until the upgrade is applied","reach":"network","title":"Apache IoTDB: missing authentication lets unauthenticated users reach a critical function","impact":"high","summary":"Apache IoTDB versions 2.0.0 through 2.0.10 expose a critical function without requiring authentication. An attacker who can reach the server over the network can invoke that function without credentials.","category":"package","nicknames":[],"who_cares":["apache-iotdb","self-hosted","iot","database"],"confidence":0.5,"needs_auth":"no","worst_case":"unauthenticated remote callers reach a critical function; impact unknown","analyst_note":"Find the NVD or Apache advisory to confirm which function lacks authentication and what it allows.","how_to_check":"- Check the installed IoTDB version with `sbin/start-confignode.sh -v` or the version in the server log header\n- Confirm the version is in the affected range `2.0.0` to `2.0.10`\n- unknown which specific function is exposed; the sources do not say","needs_analyst":true,"not_affected_if":["version-2.0.11-or-later","isolated-network"],"who_is_affected":"Teams running Apache IoTDB 2.0.0 through 2.0.10 that expose its service ports to networks beyond trusted hosts are exposed. Deployments limited to a locked-down internal network with strict access control carry less risk, but the sources do not specify which function is involved, so exposure beyond that is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000622,"input_tokens":3321,"output_tokens":580,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-59562':14A,17A '2.0.0':30B,71C '2.0.10':32B '2.0.11':73C,81C 'affect':67C 'apach':1A,19B,27B,63C,68C 'apache-iotdb':18B 'attack':41B 'authent':4A,39B,57C 'credenti':55B 'critic':10A,35B,59C 'cve':12A,15A 'databas':21B 'expos':33B 'fix':83C 'function':11A,36B,53B,60C 'host':26B 'invok':51B 'iot':22B 'iotdb':2A,20B,28B,64C,69C 'issu':66C,85C 'let':5A 'miss':3A,56C 'network':49B 'packag':23B 'reach':8A,44B 'recommend':76C 'requir':38B 'self':25B 'self-host':24B 'server':46B 'unauthent':6A 'upgrad':78C 'user':7A,74C 'version':29B,80C 'vulner':61C 'without':37B,54B","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache IoTDB 2.0.0 through 2.0.10 that expose its service ports to networks beyond trusted hosts are exposed. Deployments limited to a locked-down internal network with strict access control carry less risk, but the sources do not specify which function is involved, so exposure beyond that is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T12:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59562","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59562","severity":null,"published_at":"2026-10-21T12:17:22+00:00","modified_at":"2026-10-22T16:56:52+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-59562","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-59562","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}