Executive brief
TDengine is an open-source time-series database designed for Internet of Things (IoT) applications. A security vulnerability allows an authorized user with specific administrative privileges to upload and execute malicious code directly on the database server. If exploited, this could lead to a complete takeover of the server, allowing the attacker to steal data, disrupt operations, or use the server as a foothold for further attacks.
Technical details
A code injection vulnerability (CWE-94) exists in TDengine's User-Defined Functions (UDF) implementation. The vulnerability stems from a lack of proper validation when a user with 'create udf' privileges uploads a shared library (.so file) to the server. An attacker can upload a malicious binary, register it as a UDF, and subsequently trigger arbitrary C code execution with the privileges of the database process by calling the function via a standard SQL query. This is a remote attack, though it requires high privileges (PR:H). The issue is resolved in TDengine version 3.4.1.15.
Affected products
- taosdata TDengine Prior to 3.4.1.15
Timeline
- 2026-06-26: advisory: Initial GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date
- 2026-07-15: patched: Fix confirmed in version 3.4.1.15