CVE-2026-59229

Apache IoTDB versions 2.0.0 through 2.0.10 are vulnerable to a privilege escalation issue in the Legacy Pipe receiver protocol (specifically the handshake and sendPipeData functions). The root cause is the use of a hardcoded SUPER_USER (root) identity when executing data loading and deletion oper...

CVE-2026-59229 Apache IoTDB: Legacy Pipe Privilege Escalation

The Legacy Pipe receiver protocol handshake / sendPipeData uses a hardcoded SUPERUSER root identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges such as USEPIPE or MAINTAIN who does NOT have WRITEDATA or DELETEDATA permissions on target databases c...

Apache IoTDB security vulnerabilities

A security vulnerability exists in Apache IoTDB versions 2.0.0 through 2.0.11. This vulnerability arises because the Legacy Pipe receive protocol handshake/sendPipeData utilizes a hard-coded SUPERUSER root identity for data loading and deletion operations. Users possessing only SYSTEM-level...