Apache IoTDB 2.0.0-2.0.10 Auth Bypass CVE-2026-58663 Patched

Apache IoTDB version 2.0.11 resolves an authentication bypass vulnerability found in earlier releases of the time-series database software. The flaw, tracked as CVE-2026-58663, impacts versions 2.0.0 through 2.0.10 and involves the Thrift RPC service interface.

What happened

Security researcher Anurag Kumar identified an authentication bypass vulnerability within the Apache IoTDB Thrift RPC service. According to the oss-security mailing list advisory posted on October 21, the issue affects all versions starting from 2.0.0 up to, but not including, version 2.0.11. The advisory was posted by Haonan Hou and rates the severity as important. Kumar, an analyst, is credited with discovering the flaw in the pipeTransfer interface.

Why it matters

The vulnerability exists in the Thrift RPC service of Apache IoTDB. As Patch Gazette reported on October 16 regarding a similar issue in bbs-go, authentication flaws can expose systems to risks. This incident highlights the need to monitor open-source infrastructure components for such vulnerabilities. The advisory notes that users are recommended to upgrade to version 2.0.11 to address the issue.

What to watch

• Monitor Apache IoTDB release notes for version 2.0.11 availability.
• Review server logs for unusual Thrift RPC connection attempts.
• Verify that all instances are running patched versions.
• Check network traffic for unauthorized access patterns.

Who needs to act first

Teams usually prioritize systems exposed to untrusted networks when addressing authentication bypass vulnerabilities. Check whether your IoTDB instances are accessible from the internet or internal segments with high risk. Back up configuration files and data before applying updates to ensure recovery options exist if the patch introduces compatibility issues. Test the update in a non-production environment first to verify that application integrations function correctly after the change.

What to do and how to stay safe: Apache IoTDB

• Inventory all Apache IoTDB installations to identify versions 2.0.0 through 2.0.10.
• Plan an upgrade to version 2.0.11 during a maintenance window.
• Restrict network access to the Thrift RPC port to trusted IPs only.
• Monitor logs for suspicious authentication failures or unusual activity.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Apache IoTDB versions are affected by CVE-2026-58663?

Versions 2.0.0 before 2.0.11 are affected by this authentication bypass vulnerability.

Is there a fix available for this issue?

Yes, users are recommended to upgrade to Apache IoTDB version 2.0.11, which fixes the issue.

Who discovered the vulnerability?

The vulnerability was discovered by security analyst Anurag Kumar.