CVE-2026-62355 Overview
CVE-2026-62355 is a privilege escalation vulnerability in TDengine, an open source time-series database optimized for Internet of Things (IoT) devices. Prior to version 3.4.1.15, a Data Reader admin_user on a TDengine Cloud DB instance could execute create udf despite standard users being restricted to read-only permissions on non-database objects. Related privileged commands such as show dnodes and create user were correctly denied, making this an inconsistent access control enforcement issue. The flaw maps to CWE-269: Improper Privilege Management. TDengine has resolved the issue in version 3.4.1.15.
Critical Impact
A low-privileged Data Reader account can register user-defined functions on a TDengine Cloud DB instance, bypassing the read-only permission model expected for non-database objects.
Affected Products
- TDengine versions prior to 3.4.1.15
- TDengine Cloud DB instances with Data Reader admin_user accounts
- Deployments relying on standard user read-only enforcement for non-database objects
Discovery Timeline
- 2026-07-15 - CVE-2026-62355 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-62355
Vulnerability Analysis
The vulnerability resides in TDengine's permission enforcement layer for non-database objects. TDengine implements role-based access control that segments privileged administrative operations from read-oriented user roles. A Data Reader admin_user is expected to hold read-only permissions on non-database objects such as dnodes, users, and user-defined functions (UDFs).
The access check for create udf failed to reject the low-privileged role, while adjacent commands including show dnodes and create user correctly rejected the same account. This inconsistency allowed a Data Reader on a TDengine Cloud DB instance to register arbitrary UDFs. UDF registration is normally an administrator-only capability because UDFs execute server-side logic during query processing.
The defect is tracked under CWE-269: Improper Privilege Management. The GitHub Security Advisory GHSA-fmp7-rf4r-8q7p documents the finding and fixed release.
Root Cause
The root cause is a missing or incorrect authorization check in the code path handling the create udf statement. The server did not consistently validate that the calling principal held the required administrative privilege before accepting UDF creation requests from Data Reader accounts.
Attack Vector
Exploitation requires an authenticated Data Reader admin_user account on a TDengine Cloud DB instance reachable over the network. The attacker issues a create udf statement through any supported TDengine client interface. No user interaction is required, and the attacker gains the ability to register UDFs beyond their intended role scope.
No verified public exploit code is available for CVE-2026-62355. Refer to the TDengine security advisory for authoritative technical details.
Detection Methods for CVE-2026-62355
Indicators of Compromise
- Audit log entries showing create udf executed by accounts assigned the Data Reader role
- Presence of UDFs in the TDengine catalog that were not registered by an administrator
- Query activity invoking unexpected or newly registered UDF names
Detection Strategies
- Review TDengine server logs for create udf statements and correlate the executing principal against role assignments
- Enumerate registered UDFs on each TDengine instance and compare against an approved allowlist
- Alert when accounts with Data Reader privileges perform any DDL operation on non-database objects
Monitoring Recommendations
- Enable and centralize TDengine audit logging for all authentication and DDL events
- Track TDengine server versions across the fleet and flag instances running below 3.4.1.15
- Monitor for anomalous query patterns that reference user-defined functions not present in prior baselines
How to Mitigate CVE-2026-62355
Immediate Actions Required
- Upgrade all TDengine deployments to version 3.4.1.15 or later
- Inventory Data Reader admin_user accounts on TDengine Cloud DB instances and rotate credentials if abuse is suspected
- Audit the UDF catalog and remove any functions that cannot be attributed to an authorized administrator
Patch Information
The issue is fixed in TDengine version 3.4.1.15. Details are published in the GitHub Security Advisory GHSA-fmp7-rf4r-8q7p. Operators of managed TDengine Cloud DB instances should confirm the underlying build reflects the patched release.
Workarounds
- Restrict network access to TDengine instances so that only trusted client networks can authenticate
- Remove or disable Data Reader admin_user accounts until the upgrade to 3.4.1.15 is completed
- Periodically review the UDF catalog and delete unauthorized entries pending patch deployment
# Verify installed TDengine server version and list registered UDFs
taos -s "select server_version()"
taos -s "show functions"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
