CVE-2026-58663: Apache IoTDB Auth Bypass Vulnerability

CVE-2026-58663 Overview

CVE-2026-58663 is an authentication bypass vulnerability in Apache IoTDB's Thrift Remote Procedure Call (RPC) service. The flaw affects Apache IoTDB versions 2.0.0 through 2.0.10 and allows unauthorized access to the database engine through its RPC interface. The Apache IoTDB project has released version 2.0.11 to address the vulnerability.

Apache IoTDB is a time-series database widely used in Internet of Things (IoT) and industrial telemetry environments. Authentication bypass against its Thrift RPC endpoint exposes stored telemetry, administrative operations, and potentially downstream analytics pipelines to attackers who can reach the service.

Critical Impact

Attackers can bypass authentication on the Apache IoTDB Thrift RPC service and interact with the database without valid credentials.

Affected Products

• Apache IoTDB 2.0.0 through 2.0.10
• Apache IoTDB deployments exposing the Thrift RPC service
• IoT and time-series analytics stacks built on vulnerable Apache IoTDB releases

Discovery Timeline

• 2026-10-21 - CVE-2026-58663 published to the National Vulnerability Database (NVD)
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-58663

Vulnerability Analysis

The vulnerability resides in the authentication path of Apache IoTDB's Thrift RPC service. Thrift is the binary RPC protocol that clients use to issue queries, ingest data, and administer the IoTDB cluster. A flaw in the authentication logic lets a remote client interact with the service without presenting valid credentials.

Successful exploitation gives the attacker the same surface area that an authenticated client holds over the RPC channel. That surface typically includes reading time-series data, writing or deleting measurements, and invoking administrative statements against the storage engine. The Exploit Prediction Scoring System (EPSS) places this issue in a lower probability band at time of publication, but authentication bypasses historically see rapid weaponization once the patch is reverse engineered.

Further technical context is available in the Apache Mailing List Discussion and the OpenWall OSS-Security Update.

Root Cause

The root cause is an authentication logic defect in the Thrift RPC handler that fails to enforce credential validation on affected code paths. The National Vulnerability Database entry does not currently assign a Common Weakness Enumeration (CWE) identifier. The condition is a classic authentication bypass rather than a memory safety or injection flaw.

Attack Vector

The attack vector is network-based against the Thrift RPC port exposed by Apache IoTDB. An attacker with network reachability to the service sends crafted RPC requests that proceed without a valid credential exchange. No user interaction is required, and no prior session with the database is needed.

No verified public proof-of-concept code is referenced in the advisory. Refer to the vendor references listed above for authoritative technical details.

Detection Methods for CVE-2026-58663

Indicators of Compromise

• Thrift RPC sessions established without a preceding successful authentication handshake in IoTDB logs.
• Unexpected administrative or schema-modifying statements issued from client IPs outside the known application tier.
• Spikes in SELECT, DELETE, or metadata queries originating from previously unseen source addresses.
• Connections to the IoTDB RPC port (default 6667) from outside documented client ranges.

Detection Strategies

• Enable and centralize Apache IoTDB audit and access logs, then alert on RPC activity that is not tied to a successful login event.
• Baseline normal query patterns per client and flag deviations in query volume, statement type, or storage group access.
• Inspect network telemetry for new or unauthorized peers establishing Thrift sessions to IoTDB nodes.

Monitoring Recommendations

• Forward IoTDB server logs, host telemetry, and network flow data into a central analytics platform for correlation.
• Monitor the Apache IoTDB release channel and the referenced OSS-Security list for exploit disclosures tied to CVE-2026-58663.
• Track outbound connections from IoTDB hosts to detect data exfiltration staged after a successful bypass.

How to Mitigate CVE-2026-58663

Immediate Actions Required

• Upgrade Apache IoTDB to version 2.0.11 or later on all cluster nodes.
• Restrict network reachability to the Thrift RPC port so that only trusted application hosts can connect.
• Audit existing accounts, tokens, and recent RPC activity for signs of unauthorized access prior to patching.
• Rotate credentials used by applications and administrators that interact with the IoTDB RPC service.

Patch Information

Apache has released Apache IoTDB 2.0.11, which fixes CVE-2026-58663. Operators running any 2.0.x release from 2.0.0 through 2.0.10 must upgrade. Confirm the fixed version is deployed on every node of a clustered deployment, including standby and read replicas, before re-exposing the RPC service.

Workarounds

• Place Apache IoTDB behind a firewall or service mesh policy that permits Thrift RPC traffic only from allow-listed client IPs.
• Terminate client connections through a reverse proxy that enforces mutual TLS and source IP restrictions until the upgrade is complete.
• Disable public network exposure of the IoTDB RPC port and require access through a VPN or bastion.
• Increase logging verbosity on IoTDB nodes to capture detailed RPC session metadata during the mitigation window.

# Example: restrict access to the IoTDB Thrift RPC port with iptables
# Replace 10.0.0.0/24 with your trusted application subnet
iptables -A INPUT -p tcp --dport 6667 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6667 -j DROP