Apache IoTDB: Authentication bypass in Thrift RPC service
Summary
An authentication bypass in the Thrift RPC service of Apache IoTDB allows a remote attacker, according to VulDB without authentication, to reach functions that should require a login. The issue affects IoTDB 2.0.0 up to 2.0.10. The CVSS 9.8 score is provisional because NVD analysis is still pending. Exploitation requires network access to the Thrift RPC endpoint.
Affected
- Apache IoTDB 2.0.0 to before 2.0.11
- Default configuration: stated as unaffected in the CVE record; verify your configuration
Fixed in
- Upgrade to Apache IoTDB 2.0.11 (recommended by Apache)
Workaround
- No vendor workaround documented. Unknown.
- General measure: restrict network access to the Thrift RPC port (default 6667) to trusted hosts only; do not expose it to the internet.
Exploitation
- Public exploit: none known (VulDB: No exploit is available).
- CISA SSVC: exploitation none, automatable yes.
- Not listed in the CISA KEV catalogue; exploitation in the wild unknown.
- Early findings; the status may change.
Our recommendation
- Upgrade Apache IoTDB to 2.0.11 as soon as possible, especially if the service is reachable beyond the internal network.
- Check whether IoTDB 2.0.x is in use and where the Thrift RPC port is reachable.
- Until upgraded, restrict access to the Thrift RPC port to trusted hosts.
- Monitor the logs of the Thrift RPC service for unexpected connections.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- oss-security: CVE-2026-58663 (Openwall) www.openwall.com
- Apache lists thread lists.apache.org
- VulDB entry 424740 vuldb.com
- OpenCVE: CVE-2026-58663 app.opencve.io
- Strix: CVE-2026-58663 www.strix.ai
- CVE record copy (ThreatInt) cve.threatint.com
- Eventus advisory on Apache IoTDB flaws advisory.eventussecurity.com
- SecurityOnline: Apache Pulsar and IoTDB vulnerabilities patched securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:21.
Original description (NVD)
An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are recommended to upgrade to version 2.0.11, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.