CVE-2026-59562: Apache IoTDB missing authentication for critical function

CVE-2026-59562 · Severity: info · Published 2026-10-21

Apache IoTDB is a database system for time-series data commonly used in IoT applications. A missing authentication check allows unauthenticated attackers to invoke critical functions, potentially enabling unauthorized data access, modification, or system compromise without requiring valid credentials.

Technologies: Apache IoTDB. Vendors: Apache.

Quick answers

Is CVE-2026-59562 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59562 being exploited in the wild.
How severe is CVE-2026-59562?
Informational severity, published 21 October 2026.
Which products and versions are affected?
Apache IoTDB 2.0.0 to 2.0.10.
Is there a fix for CVE-2026-59562?
Yes: fixed in 2.0.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59562 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59562?
Check whether you run Apache IoTDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 2.0.11

Technical details

A critical function in Apache IoTDB lacks proper authentication validation, allowing unauthenticated access via network requests. The vulnerability affects versions 2.0.0 through 2.0.10. Successful exploitation requires network connectivity to the vulnerable service and results in unauthorized execution of sensitive operations.

Affected products

  • Apache IoTDB 2.0.0 to 2.0.10

Timeline

  • 2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.