# CVE-2026-62355: TDengine improper privilege management in Cloud DB instances

Source: https://junglewise.ai/threats/cve-2026-62355-tdengine-improper-privilege-management-in-cloud-db-instances  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-62355 · Severity: medium · CVSS 5.4 · Published 2026-07-15

TDengine is a specialized database used for managing data from Internet of Things (IoT) devices. A security flaw in certain versions allowed users with restricted 'Data Reader' permissions to perform administrative actions, such as creating user-defined functions, which should normally be blocked. This could allow a low-privileged user to modify system behavior or potentially disrupt operations, though it does not directly grant full administrative control over the entire database.

Technologies: [TAOS Data TDengine](https://junglewise.ai/threats/technologies/tdengine). Vendors: [TAOS Data](https://junglewise.ai/threats/vendors/taos-data).

## Quick answers

**Is CVE-2026-62355 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62355 being exploited in the wild.

**How severe is CVE-2026-62355?** Medium severity, with a CVSS score of 5.4, published 15 July 2026.

**Which products and versions are affected?** TAOS Data TDengine < 3.4.1.15.

**Is there a fix for CVE-2026-62355?** A patch was published on 2026-07-15: Fix confirmed in version 3.4.1.15 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62355 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-62355?** Check whether you run TAOS Data TDengine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege management vulnerability (CWE-269) exists in TDengine Cloud DB instances. The root cause is an improper authorization check where users assigned the 'Data Reader' role—who should be restricted to read-only access for non-database objects—are permitted to execute 'create udf' commands. While other administrative actions like 'show dnodes' and 'create user' are correctly denied, the ability to create User-Defined Functions (UDFs) bypasses intended access controls. An authenticated attacker with low-level privileges can exploit this over the network to inject custom logic into the database environment. The issue is resolved in version 3.4.1.15.

## Affected products

- taosdata TDengine < 3.4.1.15

## Timeline

- 2026-06-26: advisory: Initial GitHub advisory published
- 2026-07-15: disclosed: NVD publication date
- 2026-07-15: patched: Fix confirmed in version 3.4.1.15

## References

- [https://github.com/taosdata/TDengine/security/advisories/GHSA-fmp7-rf4r-8q7p](https://github.com/taosdata/TDengine/security/advisories/GHSA-fmp7-rf4r-8q7p)

## Related threats

- [taosdata TDengine code injection in User-Defined Functions](https://junglewise.ai/threats/cve-2026-62350-taosdata-tdengine-code-injection-in-user-defined-functions)
- [taosdata TDengine stack buffer overflow in trimString](https://junglewise.ai/threats/cve-2026-62349-taosdata-tdengine-stack-buffer-overflow-in-trimstring)
- [TDengine integer underflow in uvConnMayGetUserInfo](https://junglewise.ai/threats/cve-2026-42542-tdengine-integer-underflow-in-uvconnmaygetuserinfo)