CVE-2026-62348
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In TDengine Enterprise before version 3.4.1.15, an authenticated low-privilege SQL user could run KILL SSMIGRATE <id> against an active shared-storage migration because the MND_OPER_SSMIGRATE_DB privilege check was commented out in mndProcessKillSsMigrateReq.
Risk Assessment
An attacker can disrupt critical data migrations in the cluster, leading to system downtime, data inconsistency, or delays in migration processes.
Recommendation
Immediately upgrade TDengine Enterprise to version 3.4.1.15 or later, which includes a fix that restores proper privilege checking.
Other vulnerabilities in TDengine
See all- CVE-2026-62355Medium
In TDengine prior to version 3.4.1.15, a Data Reader user with admin_user role on a TDengine Cloud DB instance could execute create udf, even though standard users should have read-only permissions for non-database objects and commands like show dnodes and create user were denied.
- CVE-2026-62353Medium
In TDengine before version 3.4.1.14, the tGetToken() function in the SQL parser mishandles string literals ending with a backslash, causing an out-of-bounds read. An authenticated user can submit a crafted SQL query to crash the server and potentially leak adjacent memory.
- CVE-2026-62351High
In TDengine before version 3.4.1.15, the transDecompressMsg() function reads the STransCompMsg.contLen field without first validating that the RPC packet contains the 8-byte STransCompMsg structure, leading to an unauthenticated out-of-bounds read, uncontrolled allocation, integer underflow, and server crash.
- CVE-2026-62350High
In TDengine prior to version 3.4.1.15, a user with create UDF privilege can upload a crafted shared library and install it as a user-defined function, then execute arbitrary C code on the server side through database queries.
- CVE-2026-62349High
In TDengine version 3.4.1.6 and earlier, the trimString() function in parUtil.c incorrectly checks string length before processing SQL escape sequences, leading to a one-byte out-of-bounds write to the stack buffer tmpTokenBuf. This can cause denial of service and potentially remote code execution.
- CVE-2026-42542High
TDengine versions 3.4.0.0 through 3.4.1.5 allow an unauthenticated remote attacker to crash the taosd server process by sending a single crafted RPC packet. The issue is fixed in version 3.4.1.6.
Original NVD description (English source)
TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, TDengine Enterprise allowed an authenticated low-privilege SQL user to run KILL SSMIGRATE <id> against an active shared-storage migration because mndProcessKillSsMigrateReq called mndKillSsMigrate while the intended MND_OPER_SSMIGRATE_DB privilege check was commented out. This issue is fixed in version 3.4.1.15.