Apache IoTDB’s Thrift RPC service contains a flaw in the pipeTransfer() interface that allows an attacker to bypass authentication checks. The vulnerability is classified as an authentication bypass, meaning the attacker can perform actions normally protected by user authentication. The description does not explicitly state what specific actions can be taken beyond the loss of authentication.

The affected product is Apache IoTDB versions starting at 2.0.0 up to but not including 2.0.11. Any deployment running any of those releases is at risk. The vendor identified the issue within the Thrift RPC service exposed by the IoTDB server.

The CVSS score for this vulnerability is 9.8, and the EPSS score is < 1%, indicating a high severity but very low probability of exploitation. Because the flaw provides direct authentication bypass, an attacker could potentially perform unauthorized actions on the database. No publicly active exploit is listed in the CISA KEV catalog, so there is no evidence of a publicly active exploit yet, but the absence of such a listing does not reduce the risk, especially for exposed Thrift services.