Apache IoTDB: Hardcoded root identity in Legacy Pipe allows privilege escalation
Summary
Apache IoTDB versions 2.0.0 before 2.0.11 use a hardcoded SUPER_USER (root) identity in the Legacy Pipe receiver protocol when loading and deleting data. An authenticated user with only SYSTEM-level privileges such as USE_PIPE or MAINTAIN, but without WRITE_DATA or DELETE_DATA on the target databases, can send crafted PipeData messages and have data loaded or deleted as root. This bypasses IoTDB's permission model.
Affected
- Apache IoTDB 2.0.0 to before 2.0.11
Fixed in
- Apache IoTDB 2.0.11
Workaround
- Unknown. No vendor workaround is documented.
- Until patched, limit USE_PIPE and MAINTAIN grants to the minimum necessary.
Exploitation
- No known exploitation in the wild (CISA SSVC: Exploitation none).
- No public proof of concept found.
Our recommendation
- Identify IoTDB servers and list accounts holding USE_PIPE or MAINTAIN.
- Upgrade IoTDB servers to 2.0.11 or later.
- Restrict network access to the IoTDB service and review pipe privileges.
- Monitor for changes in exploitation status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache oss-security advisory (Openwall) www.openwall.com
- Apache dev list advisory (mirror) www.mail-archive.com
- Apache lists thread lists.apache.org
- Vulners CVE entry vulners.com
- Strix CVE analysis www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:14.
Original description (NVD)
The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges (such as USE_PIPE or MAINTAIN) who does NOT have WRITE_DATA or DELETE_DATA permissions on target databases can send specially crafted PipeData messages through the Legacy Pipe API, resulting in data loading/deletion operations executed as root — effectively bypassing IoTDB's permission model entirely. This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are recommended to upgrade to version 2.0.11, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.