CVE-2026-59229: Apache IoTDB Auth Bypass Vulnerability

CVE-2026-59229 Overview

CVE-2026-59229 is a permission bypass vulnerability in Apache IoTDB. The Legacy Pipe receiver protocol executes data loading and deletion operations under a hardcoded SUPER_USER (root) identity. Authenticated users with limited SYSTEM-level privileges such as USE_PIPE or MAINTAIN can send crafted PipeData messages through the Legacy Pipe API. These messages trigger write and delete operations on databases where the caller holds no WRITE_DATA or DELETE_DATA permission. The flaw affects Apache IoTDB versions 2.0.0 through 2.0.10 and is fixed in 2.0.11.

Critical Impact
Low-privileged authenticated users can bypass the entire IoTDB permission model and perform arbitrary data loading or deletion operations as root through the Legacy Pipe receiver.

Affected Products

Apache IoTDB 2.0.0 through 2.0.10
Legacy Pipe receiver protocol (handshake / sendPipeData)
Deployments exposing the Legacy Pipe API to users holding USE_PIPE or MAINTAIN privileges

Discovery Timeline

2026-10-21 - CVE-2026-59229 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-59229

Vulnerability Analysis

Apache IoTDB enforces per-database access through permissions such as WRITE_DATA and DELETE_DATA. The Legacy Pipe receiver bypasses this model by invoking data operations with a hardcoded SUPER_USER identity rather than the authenticated caller. The receiver handles PipeData messages for cluster replication, where data has already been authorized on the sender. When the API is reachable by lower-privileged users, that assumption breaks. A caller with only USE_PIPE or MAINTAIN can submit crafted PipeData messages and have them executed as root. This is a broken access control issue in the receiver's privilege attribution logic.

Root Cause

The handshake and sendPipeData entry points attach the SUPER_USER identity to downstream data loading and deletion calls. The receiver never re-checks whether the authenticated session owns WRITE_DATA or DELETE_DATA on the target databases. Permission enforcement is delegated to a context that has already been elevated.

Attack Vector

An attacker authenticates to IoTDB with any account holding SYSTEM-level privileges such as USE_PIPE or MAINTAIN. The attacker opens a Legacy Pipe session via handshake and submits crafted PipeData messages through sendPipeData. The receiver processes the payload as root, writing or deleting time-series data in databases the attacker could not otherwise modify. No memory corruption or exploit chain is required; the bypass follows directly from the protocol's identity handling. See the Apache mailing list thread and the Openwall OSS Security update for additional context.

Detection Methods for CVE-2026-59229

Indicators of Compromise

Legacy Pipe handshake sessions originating from accounts that do not operate replication workloads.
sendPipeData requests targeting databases the authenticated principal has no WRITE_DATA or DELETE_DATA grants on.
Unexpected insertions, overwrites, or deletions in time-series databases immediately following Legacy Pipe traffic.

Detection Strategies

Audit IoTDB server logs for Legacy Pipe receiver activity and correlate the authenticated user against the target database permissions.
Compare the session principal recorded at handshake with the identity used for the resulting data operations; a mismatch indicates the hardcoded SUPER_USER path.
Flag any USE_PIPE or MAINTAIN account that initiates sendPipeData without a legitimate cluster replication peer.

Monitoring Recommendations

Enable verbose audit logging on IoTDB and forward records to a central analytics platform for permission-vs-action correlation.
Alert on new accounts receiving USE_PIPE or MAINTAIN grants, and review their Legacy Pipe usage.
Monitor network connections to the Legacy Pipe receiver port from unexpected client IP ranges.

How to Mitigate CVE-2026-59229

Immediate Actions Required

Upgrade Apache IoTDB to version 2.0.11 on all cluster nodes.
Inventory accounts holding USE_PIPE or MAINTAIN and revoke privileges that are not operationally required.
Restrict network access to the Legacy Pipe receiver so only trusted replication peers can reach it.

Patch Information

The Apache IoTDB project fixes this issue in version 2.0.11. The patched receiver no longer attaches a hardcoded SUPER_USER identity to Legacy Pipe data operations and enforces WRITE_DATA and DELETE_DATA checks against the authenticated session. Upgrade details are available in the Apache mailing list announcement.

Workarounds

Disable the Legacy Pipe receiver on nodes that do not require it until the upgrade is complete.
Place network ACLs or a firewall in front of the Legacy Pipe port to allow only known replication endpoints.
Rotate credentials for any account that was previously granted USE_PIPE or MAINTAIN on exposed clusters.

bash

# Verify installed IoTDB version and confirm upgrade to 2.0.11 or later
./sbin/start-cli.sh -h 127.0.0.1 -p 6667 -u root -pw <password> \
  -e "SHOW VERSION"

# Review accounts holding pipe-related privileges
# (run inside the IoTDB CLI)
LIST USER;
LIST PRIVILEGES OF USER <username>;