The pipe processor in Apache IoTDB accepts a fully qualified Java class name from external input and uses Class.forName() to instantiate it. The absence of any validation or allowlist means an attacker can supply any class name, resulting in arbitrary code execution with the process’s privileges. This flaw is a classic unsafe reflection vulnerability, categorized as CWE‑470, and poses a high‑severity risk to confidentiality, integrity, and availability of the affected systems.

Apache IoTDB versions 1.0.0 through 2.0.9 are affected. All releases prior to 2.0.10 contain the vulnerable code path.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. The EPSS score is less than 1%, suggesting a low probability of exploitation at this time, and the flaw is not listed in the CISA KEV catalog. It is inferred that the attack vector is the pipe transfer RPC interface exposed by IoTDB, wherein a remote attacker can transmit malicious class names over the network to trigger the unsafe instantiation.