Executive brief
TDengine Enterprise, a database optimized for Internet of Things (IoT) data, contains a flaw that allows users with low-level access to disrupt critical data operations. Specifically, an unauthorized user can prematurely terminate 'shared-storage migration' tasks, which are responsible for moving database records to long-term storage. This can lead to operational delays and interfere with how the database manages its storage resources.
Technical details
A missing authorization vulnerability (CWE-862) exists in TDengine Enterprise prior to version 3.4.1.15. The root cause is located in the mnode handler function `mndProcessKillSsMigrateReq`, where the intended `MND_OPER_SSMIGRATE_DB` privilege check was commented out in the source code. This allows an authenticated user with low privileges to execute the `KILL SSMIGRATE <id>` command against active shared-storage migrations, even if they lack the necessary administrative rights. An attacker who can identify a migration ID can successfully terminate and drop migration tasks, impacting data movement and availability. The issue is resolved in version 3.4.1.15 by restoring the privilege check.
Affected products
- taosdata TDengine Enterprise < 3.4.1.15
Timeline
- 2026-06-26: advisory: Vendor advisory published on GitHub
- 2026-07-15: disclosed: CVE published to NVD