The Legacy Pipe receiver protocol in Apache IoTDB uses a hardcoded SUPER_USER identity when executing data loading and deletion operations. This allows a user with only SYSTEM-level privileges, but lacking WRITE_DATA or DELETE_DATA rights, to send specially crafted PipeData messages through the Legacy Pipe API and cause those operations to run with root privileges. The flaw results in bypassing the permission model entirely, leading to unauthorized data manipulation. This reflects a hard‑coded privileged account weakness and improper privilege management.

The vulnerability affects Apache IoTDB versions starting from 2.0.0 up to, but not including, 2.0.11. Users running those releases are susceptible. Later releases, starting with 2.0.11, contain the fix.

The EPSS score is not available and it is not listed in the CISA KEV catalog, indicating there is no publicly known exploitation at the time of this analysis. The CVSS score is not provided, but the described ability to execute data loading and deletion operations with root privileges suggests high severity. The likely attack vector involves an adversary with access to the Legacy Pipe API, either through legitimate use or by compromising a user with SYSTEM-level capabilities. If such access is achieved, the attacker can craft PipeData messages to trigger root‑level writes or deletions, effectively bypassing all audit and permission checks.