The Legacy Pipe receiver protocol in Apache IoTDB uses a hardcoded SUPER_USER identity when executing data loading and deletion operations. This allows a user with only SYSTEM-level privileges, but lacking WRITE_DATA or DELETE_DATA rights, to send specially crafted PipeData messages through the Legacy Pipe API and cause those operations to run with root privileges. The flaw results in bypassing the permission model entirely, leading to unauthorized data manipulation. This reflects a hard‑coded privileged account weakness and improper privilege management.

The vulnerability affects Apache IoTDB versions starting from 2.0.0 up to, but not including, 2.0.11. Users running those releases are susceptible. Later releases, starting with 2.0.11, contain the fix.

The EPSS score of < 1% together with the absence of a listing in the CISA KEV catalog indicates a low likelihood of documented exploitation at this time. The CVSS score of 8.8 confirms a high severity impact, reflecting the ability to perform data loading and deletion as root. The likely attack vector involves an adversary with access to the Legacy Pipe API, either through legitimate use or by compromising a user with SYSTEM-level capabilities. If such access is achieved, the attacker can craft PipeData messages to trigger root‑level writes or deletions, effectively bypassing all audit and permission checks.