CVE-2026-59562: Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC

[Haonan Hou <haonan () apache org>]

Severity: important 

Affected versions:

- Apache IoTDB 2.0.0 before 2.0.11

Description:

Missing authentication for critical function vulnerability in Apache IoTDB.



This issue affects Apache IoTDB: from 2.0.0 before 2.0.11.



Users are recommended to upgrade to version 2.0.11, which fixes the issue.

Credit:

tonghuaroot (finder)
Opr4 (finder)

References:

https://iotdb.apache.org
https://www.cve.org/CVERecord?id=CVE-2026-59562