CVE-2026-59229— Apache IoTDB: Legacy Pipe Privilege Escalation
Quick assessment
Affected
Apache Software Foundation Apache IoTDB
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Legacy Pipe 接收端协议（握手/发送 PipeData）在执行数据加载和删除操作时，使用了硬编码的 SUPER_USER（root）身份。仅拥有 SYSTEM 级别权限（例如 USE_PIPE 或 MAINTAIN）但未获得目标数据库 WRITE_DATA 或 DELETE_DATA 权限的用户，可以通过 Legacy Pipe API 发送特制的 PipeData 消息，从而以 root 身份执行数据加载或删除操作——这实际上完全绕过了 IoTDB 的权限模型。 该问题影响 Apache IoTDB 版
Possible ATT&CK Techniques 2 AI
T1548 · Abuse Elevation Control Mechanism T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-59229
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache IoTDB: Legacy Pipe Privilege Escalation
Source: CVE Program / CVE List V5
Vulnerability Description
The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a
hardcoded SUPER_USER (root) identity when executing data loading and
deletion operations. A user with only SYSTEM-level privileges (such as
USE_PIPE or MAINTAIN) who does NOT have WRITE_DATA or DELETE_DATA
permissions on target databases can send specially crafted PipeData
messages through the Legacy Pipe API, resulting in data loading/deletion
operations executed as root — effectively bypassing IoTDB's permission
model entirely.
This issue affects Apache IoTDB: from 2.0.0 before 2.0.11.
Users are recommended to upgrade to version 2.0.11, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache IoTDB | 2.0.0 ~ 2.0.11 | - |
|
II. Public POCs for CVE-2026-59229
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59229
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-59229 (1)
Same Patch Batch · Apache Software Foundation · 2026-10-21 · 59 CVEs total
| CVE-2026-111813 | 10.0 CRITICAL | Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick |
| CVE-2026-105944 | 10.0 CRITICAL | Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Puls |
| CVE-2026-111816 | 9.3 CRITICAL | Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the |
| CVE-2026-105869 | 9.2 CRITICAL | Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for |
| CVE-2025-31699 | 8.9 HIGH | Apache Traffic Server: Origin connection still owed a request body is reused, enabling req |
| CVE-2026-105937 | 8.7 HIGH | Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant messag |
| CVE-2025-55702 | 8.7 HIGH | Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new requ |
| CVE-2026-111804 | 8.2 HIGH | Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest met |
| CVE-2026-105942 | 7.7 HIGH | Apache Pulsar: Original principal of proxied requests authorized with the proxy's authenti |
| CVE-2026-105945 | 7.7 HIGH | Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package |
| CVE-2026-105934 | 7.2 HIGH | Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topi |
| CVE-2026-105930 | 6.0 MEDIUM | Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cro |
| CVE-2026-105936 | 5.3 MEDIUM | Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of t |
| CVE-2026-105926 | 5.3 MEDIUM | Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSch |
| CVE-2026-105935 | 4.9 MEDIUM | Apache Pulsar: Function trigger publishes to the input topic without checking the caller's |
| CVE-2026-105927 | 2.3 LOW | Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows write |
| CVE-2026-105938 | 2.3 LOW | Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog |
| CVE-2026-105932 | 2.3 LOW | Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter end |
| CVE-2026-105931 | 2.3 LOW | Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction co |
| CVE-2026-105933 | 2.3 LOW | Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic |
Showing top 20 of 59 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache IoTDB
-
CVE-2026-59562
Apache IoTDB: Remote code execution and Unauthenticated path -
CVE-2026-58663
Apache IoTDB: Auth Bypass in pipeTransfer() interface -
CVE-2026-44630
Apache IoTDB: RPC service denial of service via unchecked Th -
CVE-2026-40452
Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery -
CVE-2026-40009
Apache IoTDB: Authenticated users can escalate to full tree-
Same vendor: Apache Software Foundation
-
CVE-2026-111816
Apache Traffic Server: A malformed 302 response bypasses par -
CVE-2025-55702
Apache Traffic Server: An unread Expect: 100-continue reques -
CVE-2025-31699
Apache Traffic Server: Origin connection still owed a reques -
CVE-2026-111804
Apache Traffic Server: wasm plugin has a use-after-free and -
CVE-2026-111813
Apache Traffic Server: magick plugin passes client query str
V. Comments for CVE-2026-59229
No comments yet