CVE-2026-62350 Overview
CVE-2026-62350 is a code injection vulnerability in TDengine, an open-source time-series database optimized for Internet of Things (IoT) workloads. The flaw affects TDengine versions prior to 3.4.1.15. An authenticated user holding the create udf privilege can upload a crafted shared library and register it as a user-defined function (UDF) such as eval. Invoking that function through a database query executes arbitrary C code in the context of the TDengine server process. The issue is tracked under CWE-94: Improper Control of Generation of Code and is fixed in version 3.4.1.15.
Critical Impact
Authenticated attackers with UDF creation rights can execute arbitrary native code on the TDengine server, leading to full compromise of database confidentiality, integrity, and availability.
Affected Products
- TDengine versions prior to 3.4.1.15
- Deployments exposing UDF creation privileges to non-administrative accounts
- IoT and time-series workloads relying on vulnerable TDengine instances
Discovery Timeline
- 2026-07-15 - CVE-2026-62350 published to the National Vulnerability Database (NVD)
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-62350
Vulnerability Analysis
TDengine supports user-defined functions that extend query capabilities through native shared libraries. The server loads these libraries at runtime and invokes exported symbols when the associated function is referenced in SQL. The vulnerability arises because the UDF installation workflow accepts attacker-controlled binary content without restricting the code paths that will subsequently execute inside the database process.
Once a UDF such as eval is registered, any query that references it triggers execution of the attacker's shared library. Because the library runs in-process with the TDengine daemon, the attacker gains code execution with the privileges of the database service account. Successful exploitation results in complete loss of confidentiality, integrity, and availability of stored time-series data.
Root Cause
The root cause is improper control of code generation during UDF registration. TDengine treats the create udf privilege as a trust boundary that permits loading arbitrary native code, without sandboxing or validating the uploaded library. Any account holding this privilege effectively holds remote code execution against the server.
Attack Vector
Exploitation requires network access to the TDengine service and an authenticated session with high privileges — specifically, the create udf capability. The attacker compiles a malicious shared object that exports a symbol matching the UDF entrypoint contract, uploads it through the UDF creation API, and then issues a query invoking the function. No user interaction is required, and the attack executes over the standard TDengine protocol.
The vulnerability is described in the TDengine GitHub Security Advisory (GHSA-f7wh-p233-87xv). No public proof-of-concept exploit code has been released at the time of publication.
Detection Methods for CVE-2026-62350
Indicators of Compromise
- Unexpected CREATE FUNCTION or UDF registration statements in TDengine audit logs, particularly from non-administrative accounts
- New or modified shared library files (.so, .dll) in the TDengine UDF storage directory that do not match approved deployments
- Outbound network connections, shell processes, or file writes originating from the TDengine server process (taosd)
- Query patterns invoking uncommon UDFs such as eval shortly after a UDF registration event
Detection Strategies
- Enable and centrally collect TDengine audit logs, then alert on any UDF creation event tied to accounts other than approved database administrators.
- Baseline the contents of the UDF library directory and alert on unexpected file additions or modifications through file integrity monitoring.
- Correlate database privilege changes that grant create udf with subsequent UDF registration and query execution within a short time window.
Monitoring Recommendations
- Monitor child process creation from the taosd process; the database should rarely spawn shells, interpreters, or network utilities.
- Track outbound network flows from database hosts and alert on connections to non-approved destinations.
- Review TDengine role assignments periodically to confirm the create udf privilege is limited to trusted administrators.
How to Mitigate CVE-2026-62350
Immediate Actions Required
- Upgrade all TDengine instances to version 3.4.1.15 or later, which contains the vendor fix.
- Audit existing accounts and revoke the create udf privilege from any user that does not explicitly require it.
- Inventory registered UDFs and remove any function whose provenance cannot be verified.
- Restrict network exposure of the TDengine service to trusted management networks only.
Patch Information
The vendor addressed CVE-2026-62350 in TDengine 3.4.1.15. Refer to the TDengine GitHub Security Advisory for release notes and upgrade guidance.
Workarounds
- Revoke the create udf privilege from all non-administrative roles until the upgrade is complete.
- Place TDengine behind network segmentation or firewall rules that restrict access to authorized application servers.
- Deploy file integrity monitoring on the UDF library directory to detect unauthorized shared library uploads.
- Enforce strong authentication and rotate credentials for any account that historically held UDF creation rights.
# Revoke UDF creation from a non-admin user in TDengine
REVOKE create udf ON *.* FROM 'app_user';
# Verify installed TDengine version (should be 3.4.1.15 or later)
taos -s "SELECT server_version();"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
