CVE-2026-58663

Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass in Apache IoTDB Thrift RPC Service

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: Apache Software Foundation

Description

An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are recommended to upgrade to version 2.0.11, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-58663

EUVD

EUVD-2026-107162

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache IoTDB	2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This is an authentication bypass vulnerability in Apache IoTDB's Thrift RPC service. It allows unauthorized access to the system by bypassing normal authentication mechanisms. The flaw exists in versions 2.0.0 through 2.0.10.

Detection Guidance

To detect this vulnerability, check the version of Apache IoTDB running on your system. If it is between 2.0.0 and 2.0.10, it is vulnerable. Upgrade to version 2.0.11 or later to mitigate the risk.

Impact Analysis

An attacker could exploit this to gain unauthorized access to Apache IoTDB, potentially leading to data theft, manipulation, or denial of service. Systems using affected versions are at risk until patched.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles or HIPAA's security requirements. Compliance may be compromised if sensitive data is exposed.

Mitigation Strategies

Upgrade Apache IoTDB to version 2.0.11 or later to fix the authentication bypass vulnerability in the Thrift RPC service.

Hi! I’m here to help you understand CVE-2026-58663. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...