Authentication Bypass in Apache IoTDB Thrift RPC Service
CVE-2026-58663

Currently unrated

Key Information:

Vendor: Apache
Status: Apache Iotdb
Vendor: CVE Published:; 21 October 2026

What is CVE-2026-58663?

An authentication bypass vulnerability exists in the Thrift RPC service of Apache IoTDB, allowing potential unauthorized access to sensitive data. This issue impacts versions 2.0.0 through 2.0.10. Users are highly advised to upgrade to version 2.0.11 or later to mitigate this vulnerability and ensure the security of their systems.

Affected Version(s)

Apache IoTDB 2.0.0 < 2.0.11

References

https://lists.apache.org/thread.html/bt2o8n1bb3cv9h7k6rph...

vendor-advisory

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 21, 2026
Vulnerability Reserved
Jul 2, 2026

Credit

Anurag Kumar (https://www.linkedin.com/in/anurag-kumar-8413a0197)

CVE-2026-58663 Data

JSON