CYBERSECURITYTRACKER
Permanent story citation

CVE-2026-58663: Apache IoTDB: Auth Bypass in pipeTransfer() interface

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 10953

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2026-58663: Apache IoTDB: Auth Bypass in pipeTransfer() interface

CVE-2026-58663 is an authentication bypass vulnerability in Apache IoTDB's Thrift RPC service affecting versions 2.0.0 before 2.0.11. The flaw exists in the pipeTransfer() interface and is rated important severity. Apache released version 2.0.11 to remediate the issue.

Why it matters: Organizations running Apache IoTDB 2.0.0 through 2.0.10 can be accessed without valid credentials via the Thrift RPC service; upgrade to 2.0.11 immediately to close this authentication bypass.

CVEsCVE-2026-58663
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary