CVE-2026-58663

{
  "etk_id": "ETK-2026-2314",
  "cve_id": "CVE-2026-58663",
  "display_id": "CVE-2026-58663",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-107162",
  "status": "in_pipeline",
  "anchor_state": "anchored",
  "title": "Authentication bypass in Apache IoTDB Thrift RPC service",
  "summary": "Apache IoTDB versions 2.0.0 through 2.0.10 are affected by an authentication bypass in the Thrift RPC service. An attacker able to reach the affected service may access it without completing normal authentication.",
  "mitigation": "Upgrade Apache IoTDB to version 2.0.11. Restrict network access to the Thrift RPC service until the upgrade is complete.",
  "vendor": "Apache Software Foundation",
  "product": "Apache IoTDB",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.0.0, < 2.0.11"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.0.11"
      ],
      "package_name": "Apache IoTDB",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": null,
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": null,
  "t0_at": "2026-10-21T11:03:23.887000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-21T11:03:23.887000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T11:03:23.887000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58663"
    }
  }
}