CVE-2026-59229 Apache IoTDB: Legacy Pipe Privilege Escalation
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-59229?
CVE-2026-59229 is a vulnerability in Apache IoTDB, published on 21 Oct 2026.
Official description
The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges (such as USE_PIPE or MAINTAIN) who does NOT have WRITE_DATA or DELETE_DATA permissions on target databases can send specially crafted PipeData messages through the Legacy Pipe API, resulting in data loading/deletion operations executed as root — effectively bypassing IoTDB's permission model entirely.
This issue affects Apache IoTDB: from 2.0.0 before 2.0.11.
Users are recommended to upgrade to version 2.0.11, which fixes the issue.
Which versions are affected by CVE-2026-59229?
How do I fix CVE-2026-59229?
No fix has been published for CVE-2026-59229 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-59229 being exploited?
There is no known exploitation of CVE-2026-59229 in the wild and no public exploit code.
Sources
Also known as GHSA-6m49-362q-wcpg.