CVE-2026-62348 Overview
CVE-2026-62348 is a missing authorization vulnerability [CWE-862] affecting TDengine Enterprise, a time-series database optimized for Internet of Things (IoT) devices. The flaw exists in versions prior to 3.4.1.15 and allows authenticated low-privilege SQL users to terminate active shared-storage migrations. The mndProcessKillSsMigrateReq handler invokes mndKillSsMigrate without enforcing the intended MND_OPER_SSMIGRATE_DB privilege check, which was commented out in the source code. An attacker with basic SQL access can issue KILL SSMIGRATE <id> to disrupt administrative database operations.
Critical Impact
Authenticated low-privilege users can terminate active shared-storage migration operations in TDengine Enterprise, disrupting database administration workflows and impacting data integrity and availability.
Affected Products
- TDengine Enterprise versions prior to 3.4.1.15
- TDengine shared-storage migration (SSMIGRATE) subsystem
- Deployments using the MND (management node) operation privilege framework
Discovery Timeline
- 2026-07-15 - CVE-2026-62348 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-62348
Vulnerability Analysis
The vulnerability resides in TDengine's management node request handling for the KILL SSMIGRATE SQL command. TDengine Enterprise implements a shared-storage migration feature that allows administrators to move data across storage tiers. Termination of these migrations should be restricted to users holding the MND_OPER_SSMIGRATE_DB operational privilege.
In affected versions, the function mndProcessKillSsMigrateReq calls mndKillSsMigrate directly. The privilege check that would validate the caller's authorization was commented out in the code path. Any authenticated SQL user, including accounts intended to have minimal read or write scope, can therefore issue the kill command and terminate migrations in progress.
This represents a broken access control condition rather than a code execution flaw. The impact is limited to integrity and availability of migration operations, aligning with the partial integrity and availability impacts reflected in the vulnerability scoring.
Root Cause
The root cause is a missing authorization check [CWE-862]. Development or debugging activity left the MND_OPER_SSMIGRATE_DB privilege verification commented out in mndProcessKillSsMigrateReq. The handler proceeded to execute the privileged termination logic without validating that the requesting session had the operational privilege required for shared-storage migration control.
Attack Vector
Exploitation requires network access to the TDengine service and valid credentials for any SQL user account. The attacker connects using standard TDengine client protocols and issues KILL SSMIGRATE <id> against an active migration identifier. No user interaction, elevated privileges, or complex preconditions are required. Migration identifiers can be enumerated through standard query interfaces observable to authenticated users.
No verified public exploit code is currently available. Refer to the GitHub Security Advisory GHSA-67g2-ffwr-7x9h for maintainer-provided technical details.
Detection Methods for CVE-2026-62348
Indicators of Compromise
- Unexpected KILL SSMIGRATE statements in TDengine query audit logs originating from non-administrative user accounts
- Shared-storage migration jobs terminating prematurely without corresponding administrator activity
- Repeated migration restart attempts by administrators following unexplained cancellations
Detection Strategies
- Enable and review TDengine SQL audit logging to capture all KILL statements with associated user identity and source address
- Correlate migration lifecycle events (start, progress, termination) against the identity of the invoking session
- Alert on any KILL SSMIGRATE invocation issued by an account outside an approved administrator list
Monitoring Recommendations
- Monitor TDengine management node logs for mndProcessKillSsMigrateReq handler invocations
- Track migration state transitions and flag terminations that occur without matching change-management records
- Baseline normal administrative behavior and alert on privilege-relevant SQL commands from low-privilege accounts
How to Mitigate CVE-2026-62348
Immediate Actions Required
- Upgrade TDengine Enterprise to version 3.4.1.15 or later, which restores the MND_OPER_SSMIGRATE_DB privilege check
- Audit existing TDengine user accounts and remove SQL access for identities that do not require it
- Review recent audit logs for unauthorized KILL SSMIGRATE activity and validate that all migrations completed as intended
Patch Information
The vendor addressed the vulnerability in TDengine version 3.4.1.15 by reinstating the MND_OPER_SSMIGRATE_DB authorization check within mndProcessKillSsMigrateReq. Patch details are documented in the GitHub Security Advisory GHSA-67g2-ffwr-7x9h.
Workarounds
- Restrict network access to TDengine management node ports to trusted administrative subnets only
- Limit SQL user account creation and enforce least-privilege role assignments until the patch is deployed
- Enable comprehensive SQL audit logging to detect and respond to unauthorized migration termination attempts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
