AI and data stack advisories

Severe, 6 weeks977Projects326

977 severe, 6 weeks · 326 projects

Apache Software FoundationCVE-2026-58663

Apache IoTDB: authentication bypass

Apache Software Foundation

CVE-2026-58663 · Published Oct 21, 2026 · updated Oct 30, 2026

Critical9.8
Fix: upgrade to 2.0.11 or later
Apache Software Foundation advisory

An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service

This issue affects Apache IoTDB: from 2.0.0 before 2.0.11.

Users are recommended to upgrade to version 2.0.11, which fixes the issue.

Affected versions

PackageAffectedFixed in
Apache IoTDB
Product
>= 2.0.0, < 2.0.112.0.11
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
CISA (its enrichment of the CVE record)
Weakness
CWE-287

More Apache Software Foundation advisories

All Apache Software Foundation
Medium 6.9Oct 21Apache Traffic Server: request smugglingCVE-2026-111809no fix yetLow 2.3Oct 21Apache Pulsar: missing authorizationCVE-2026-105931fixed in 4.0.14 +1High 7.0Oct 21Apache Traffic Server: request smugglingCVE-2025-55702no fix yetCritical 9.1Oct 21Apache Traffic Server: request smugglingCVE-2025-31699no fix yetCritical 9.2Oct 21Apache Pulsar: improper signature checkCVE-2026-105869fixed in 4.0.14 +1Medium 5.3Oct 21Apache Pulsar: missing authorizationCVE-2026-105926fixed in 4.0.14 +1