Read the docs
TI-2026-44502 Aliases CVE-2026-62348

TDengine: KILL SSMIGRATE missing authorization lets low-privilege users interrupt shared-storage migrations

Priority MEDIUM 58CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, TDengine Enterprise allowed an authenticated low-privilege SQL user to run KILL SSMIGRATE <id> against an active shared-storage migration because mndProcessKillSsMigrateReq called mndKillSsMigrate while the intended MND_OPER_SSMIGRATE_DB privilege check was commented out. This issue is fixed in version 3.4.1.15.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00252 16th percentileScored 2026-11-07
Fix Fixed TDengine (taosdata): 3.4.1.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
taosdataTDenginebefore 3.4.1.153.4.1.15Patch availableCNA
  • TDengine Vendortaosdata Affected before 3.4.1.15 Fixed in 3.4.1.15 Patch available CNA

Remediation

  • Fix · CNA TDengine (taosdata) Fixed in 3.4.1.15

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-62348

References

Other 1

  • TI-2023-16957 Command Injection Vulnerability in `Release PR Merged` Workflow in taosdata/grafanaplugin CVSS 3.1CRITICAL 9.8
  • TI-2026-44505 TDengine: Unauthenticated Remote Denial of Service via Out-of-Bounds Read in transDecompressMsg CVSS 3.1HIGH 7.5
  • TI-2026-44503 TDengine: Off-by-One Buffer Overflow CVSS 3.1HIGH 8.3
  • TI-2026-44504 TDengine: UDF lead to RCE CVSS 3.1HIGH 7.2
  • TI-2023-19882 TDengine Database Denial-of-Service CVSS 3.1MEDIUM 6.5
  • TI-2026-44506 TDengine: Authenticated Out-of-Bounds Read in SQL Lexer tGetToken CVSS 3.1MEDIUM 5.4
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences