# CVE-2026-62348: TDengine Enterprise missing authorization in KILL SSMIGRATE

Source: https://junglewise.ai/threats/cve-2026-62348-tdengine-enterprise-missing-authorization-in-kill-ssmigrate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-62348 · Severity: medium · CVSS 5.4 · Published 2026-07-15

TDengine Enterprise, a database optimized for Internet of Things (IoT) data, contains a flaw that allows users with low-level access to disrupt critical data operations. Specifically, an unauthorized user can prematurely terminate 'shared-storage migration' tasks, which are responsible for moving database records to long-term storage. This can lead to operational delays and interfere with how the database manages its storage resources.

Vendors: [TAOS Data](https://junglewise.ai/threats/vendors/taos-data).

## Quick answers

**Is CVE-2026-62348 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62348 being exploited in the wild.

**How severe is CVE-2026-62348?** Medium severity, with a CVSS score of 5.4, published 15 July 2026.

**Which products and versions are affected?** TAOS Data TDengine Enterprise < 3.4.1.15.

**Is there a fix for CVE-2026-62348?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-62348 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-62348?** Check whether you run TAOS Data TDengine Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability (CWE-862) exists in TDengine Enterprise prior to version 3.4.1.15. The root cause is located in the mnode handler function `mndProcessKillSsMigrateReq`, where the intended `MND_OPER_SSMIGRATE_DB` privilege check was commented out in the source code. This allows an authenticated user with low privileges to execute the `KILL SSMIGRATE <id>` command against active shared-storage migrations, even if they lack the necessary administrative rights. An attacker who can identify a migration ID can successfully terminate and drop migration tasks, impacting data movement and availability. The issue is resolved in version 3.4.1.15 by restoring the privilege check.

## Affected products

- taosdata TDengine Enterprise < 3.4.1.15

## Timeline

- 2026-06-26: advisory: Vendor advisory published on GitHub
- 2026-07-15: disclosed: CVE published to NVD

## References

- [https://github.com/taosdata/TDengine/security/advisories/GHSA-67g2-ffwr-7x9h](https://github.com/taosdata/TDengine/security/advisories/GHSA-67g2-ffwr-7x9h)