CVE-2026-59562 is a vulnerability in Apache Iotdb
Published on October 21, 2026
Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC
Missing authentication for critical function vulnerability in Apache IoTDB.
This issue affects Apache IoTDB: from 2.0.0 before 2.0.11.
Users are recommended to upgrade to version 2.0.11, which fixes the issue.
Weakness Type
Missing Authentication for Critical Function
The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Products Associated with CVE-2026-59562
Want to know whenever a new CVE is published for Apache Iotdb? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache IoTDB:- Version 2.0.0 and below 2.0.11 is affected.