Privilege Escalation Vulnerability in Apache IoTDB Affecting Legacy Pipe Protocol

CVE-2026-59229

What is CVE-2026-59229?

A privilege escalation vulnerability exists in the Legacy Pipe receiver protocol of Apache IoTDB, where operations that typically require higher privileges can be executed with a hardcoded root identity. This flaw allows users with only SYSTEM-level privileges to manipulate data loading and deletion through specially crafted PipeData messages, effectively circumventing the conventional permission model. It is crucial for administrative teams to upgrade to version 2.0.11 to mitigate this security risk.

References