{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Apache Software Foundation Apache IoTDB: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/apache-software-foundation--apache-iotdb/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/apache-software-foundation--apache-iotdb/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-59229/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-59229/",
   "title": "CVE-2026-59229 · Apache Software Foundation Apache IoTDB · disclosed",
   "content_text": "The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a\nhardcoded SUPER_USER (root) identity when executing data loading and\ndeletion operations. A user with only SYSTEM-level privileges (such as\nUSE_PIPE or MAINTAIN) who does NOT have WRITE_DATA or DELETE_DATA\npermissions on target databases can send specially crafted PipeData\nmessages through the Legacy Pipe API, resulting in data loading/deletion\noperations executed as root — effectively bypassing IoTDB's permission\nmodel entirely.\n\n\n\nThis issue affects Apache IoTDB: from 2.0.0 before 2.0.11.\n\n\n\nUsers are recommended to upgrade to version 2.0.11, which fixes the issue.",
   "date_published": "2026-10-21T11:11:46Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-59562/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-59562/",
   "title": "CVE-2026-59562 · Apache Software Foundation Apache IoTDB · disclosed",
   "content_text": "Missing authentication for critical function vulnerability in Apache IoTDB.\n\n\n\nThis issue affects Apache IoTDB: from 2.0.0 before 2.0.11.\n\n\n\nUsers are recommended to upgrade to version 2.0.11, which fixes the issue.",
   "date_published": "2026-10-21T11:10:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-58663/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-58663/",
   "title": "CVE-2026-58663 · Apache Software Foundation Apache IoTDB · disclosed",
   "content_text": "An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service\n\n\n\nThis issue affects Apache IoTDB: from 2.0.0 before 2.0.11.\n\n\n\nUsers are recommended to upgrade to version 2.0.11, which fixes the issue.",
   "date_published": "2026-10-21T11:03:23Z"
  }
 ]
}