CYBERSECURITYTRACKER
Permanent story citation

CVE-2026-59229: Apache IoTDB: Legacy Pipe Privilege Escalation

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 10952

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2026-59229: Apache IoTDB: Legacy Pipe Privilege Escalation

Apache IoTDB versions before 2.0.11 contain a privilege escalation vulnerability in the Legacy Pipe receiver protocol that uses a hardcoded administrative identity for data operations. An attacker with limited SYSTEM-level privileges can exploit this by sending crafted PipeData messages to perform unauthorized data loading and deletion.

Why it matters: Organizations running Apache IoTDB 2.0.0 through 2.0.10 should immediately patch or restrict access to the Legacy Pipe protocol, as users with minimal permissions can escalate privileges to perform destructive database operations without proper authorization.

CVEsCVE-2026-59229
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary