CVE-2026-62348

TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, TDengine Enterprise allowed an authenticated low-privilege SQL user to run KILL SSMIGRATE <id> against an active shared-storage migration because mndProcessKillSsMigrateReq called mndKillSsMigrate while the intended MND_OPER_SSMIGRATE_DB privilege check was commented out. This issue is fixed in version 3.4.1.15.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/taosdata/TDengine/security/advisories/GHSA-67g2-ffwr-7x9h
https://github.com/taosdata/TDengine/security/advisories/GHSA-67g2-ffwr-7x9h

Configurations

No configuration.

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) TDengine es una base de datos de series temporales optimizada para dispositivos de internet de las cosas. Antes de la versión 3.4.1.15, TDengine Enterprise permitía a un usuario SQL autenticado con bajos privilegios ejecutar KILL SSMIGRATE [id] contra una migración de almacenamiento compartido activa porque mndProcessKillSsMigrateReq llamaba a mndKillSsMigrate mientras que la comprobación de privilegios prevista MND_OPER_SSMIGRATE_DB estaba comentada. Este problema está solucionado en la versión 3.4.1.15.

Information

Published : 2026-07-15 19:18

Updated : 2026-10-24 21:10

NVD link : CVE-2026-62348

Mitre link : CVE-2026-62348

CVE.ORG link : CVE-2026-62348

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-62348", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62348", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-16T19:12:27.209715Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "taosdata", "product": "TDengine", "versions": [{"status": "affected", "version": "< 3.4.1.15"}]}]}], "published": "2026-07-15T19:18:37.107", "references": [{"url": "https://github.com/taosdata/TDengine/security/advisories/GHSA-67g2-ffwr-7x9h", "source": "security-advisories@github.com"}, {"url": "https://github.com/taosdata/TDengine/security/advisories/GHSA-67g2-ffwr-7x9h", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, TDengine Enterprise allowed an authenticated low-privilege SQL user to run KILL SSMIGRATE <id> against an active shared-storage migration because mndProcessKillSsMigrateReq called mndKillSsMigrate while the intended MND_OPER_SSMIGRATE_DB privilege check was commented out. This issue is fixed in version 3.4.1.15."}, {"lang": "es", "value": "TDengine es una base de datos de series temporales optimizada para dispositivos de internet de las cosas. Antes de la versi\u00f3n 3.4.1.15, TDengine Enterprise permit\u00eda a un usuario SQL autenticado con bajos privilegios ejecutar KILL SSMIGRATE [id] contra una migraci\u00f3n de almacenamiento compartido activa porque mndProcessKillSsMigrateReq llamaba a mndKillSsMigrate mientras que la comprobaci\u00f3n de privilegios prevista MND_OPER_SSMIGRATE_DB estaba comentada. Este problema est\u00e1 solucionado en la versi\u00f3n 3.4.1.15."}], "lastModified": "2026-10-24T21:10:00.130", "sourceIdentifier": "security-advisories@github.com"}