# CVE-2026-62350: taosdata TDengine code injection in User-Defined Functions

Source: https://junglewise.ai/threats/cve-2026-62350-taosdata-tdengine-code-injection-in-user-defined-functions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-62350 · Severity: high · CVSS 7.2 · Published 2026-07-15

TDengine is an open-source time-series database designed for Internet of Things (IoT) applications. A security vulnerability allows an authorized user with specific administrative privileges to upload and execute malicious code directly on the database server. If exploited, this could lead to a complete takeover of the server, allowing the attacker to steal data, disrupt operations, or use the server as a foothold for further attacks.

Technologies: [TAOS Data TDengine](https://junglewise.ai/threats/technologies/tdengine). Vendors: [TAOS Data](https://junglewise.ai/threats/vendors/taos-data).

## Quick answers

**Is CVE-2026-62350 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62350 being exploited in the wild.

**How severe is CVE-2026-62350?** High severity, with a CVSS score of 7.2, published 15 July 2026.

**Which products and versions are affected?** TAOS Data TDengine Prior to 3.4.1.15.

**Is there a fix for CVE-2026-62350?** A patch was published on 2026-07-15: Fix confirmed in version 3.4.1.15 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62350 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-62350?** Check whether you run TAOS Data TDengine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A code injection vulnerability (CWE-94) exists in TDengine's User-Defined Functions (UDF) implementation. The vulnerability stems from a lack of proper validation when a user with 'create udf' privileges uploads a shared library (.so file) to the server. An attacker can upload a malicious binary, register it as a UDF, and subsequently trigger arbitrary C code execution with the privileges of the database process by calling the function via a standard SQL query. This is a remote attack, though it requires high privileges (PR:H). The issue is resolved in TDengine version 3.4.1.15.

## Affected products

- taosdata TDengine Prior to 3.4.1.15

## Timeline

- 2026-06-26: advisory: Initial GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date
- 2026-07-15: patched: Fix confirmed in version 3.4.1.15

## References

- [https://github.com/taosdata/TDengine/security/advisories/GHSA-f7wh-p233-87xv](https://github.com/taosdata/TDengine/security/advisories/GHSA-f7wh-p233-87xv)

## Related threats

- [TDengine improper privilege management in Cloud DB instances](https://junglewise.ai/threats/cve-2026-62355-tdengine-improper-privilege-management-in-cloud-db-instances)
- [taosdata TDengine stack buffer overflow in trimString](https://junglewise.ai/threats/cve-2026-62349-taosdata-tdengine-stack-buffer-overflow-in-trimstring)
- [TDengine integer underflow in uvConnMayGetUserInfo](https://junglewise.ai/threats/cve-2026-42542-tdengine-integer-underflow-in-uvconnmaygetuserinfo)