CVE-2026-62355
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In TDengine prior to version 3.4.1.15, a Data Reader user with admin_user role on a TDengine Cloud DB instance could execute create udf, even though standard users should have read-only permissions for non-database objects and commands like show dnodes and create user were denied.
Risk Assessment
The risk involves potential privilege escalation by a Data Reader user, which could lead to unauthorized creation of UDF functions and possible compromise of database integrity or security.
Recommendation
It is recommended to immediately upgrade TDengine to version 3.4.1.15 or later, which fixes this vulnerability.
Other vulnerabilities in TDengine
See all- CVE-2026-62353Medium
In TDengine before version 3.4.1.14, the tGetToken() function in the SQL parser mishandles string literals ending with a backslash, causing an out-of-bounds read. An authenticated user can submit a crafted SQL query to crash the server and potentially leak adjacent memory.
- CVE-2026-62351High
In TDengine before version 3.4.1.15, the transDecompressMsg() function reads the STransCompMsg.contLen field without first validating that the RPC packet contains the 8-byte STransCompMsg structure, leading to an unauthenticated out-of-bounds read, uncontrolled allocation, integer underflow, and server crash.
- CVE-2026-62350High
In TDengine prior to version 3.4.1.15, a user with create UDF privilege can upload a crafted shared library and install it as a user-defined function, then execute arbitrary C code on the server side through database queries.
- CVE-2026-62349High
In TDengine version 3.4.1.6 and earlier, the trimString() function in parUtil.c incorrectly checks string length before processing SQL escape sequences, leading to a one-byte out-of-bounds write to the stack buffer tmpTokenBuf. This can cause denial of service and potentially remote code execution.
- CVE-2026-62348Medium
In TDengine Enterprise before version 3.4.1.15, an authenticated low-privilege SQL user could run KILL SSMIGRATE <id> against an active shared-storage migration because the MND_OPER_SSMIGRATE_DB privilege check was commented out in mndProcessKillSsMigrateReq.
- CVE-2026-42542High
TDengine versions 3.4.0.0 through 3.4.1.5 allow an unauthenticated remote attacker to crash the taosd server process by sending a single crafted RPC packet. The issue is fixed in version 3.4.1.6.
Original NVD description (English source)
TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a Data Reader admin_user on a TDengine Cloud DB instance could run create udf even though standard users should have read-only permissions for non-database objects and show dnodes and create user were denied. This issue is fixed in version 3.4.1.15.