CVE-2026-62355 taosdata CVE debrief

Who should care

Defenders managing TDengine Cloud DB instances, especially those with Data Reader admin_user roles, should assess potential exposure and impact. This includes verifying instance exposure, assessing potential impact of create udf functionality, and updating to version 3.4.1.15 or later if vulnerable. Operators, platform administrators, vulnerability management teams, and security teams should review the issue and take necessary actions.

Why it matters

Defenders should care about CVE-2026-62355 as it allows Data Reader admin_user roles on TDengine Cloud DB instances to create user-defined functions, potentially leading to privilege elevation. This issue requires verification of exposure and assessment of impact on instances, especially those with Data Reader admin_user roles. The fix in version 3.4.1.15 should be applied. Evidence is limited regarding actual exploitation, affected versions, or specific consequences, so defenders must prioritize verification and remediation efforts.

• Potential unauthorized creation of user-defined functions
• Possible elevation of privileges for Data Reader admin_user roles
• Need for verification of instance exposure and version assessment

Technical summary

A Data Reader admin_user on a TDengine Cloud DB instance could run create udf despite having read-only permissions for non-database objects. This issue was fixed in version 3.4.1.15. The vulnerability allows potential unauthorized creation of user-defined functions and possible elevation of privileges for Data Reader admin_user roles. Defenders should prioritize verifying exposure and assessing potential impact on TDengine Cloud DB instances, especially those with Data Reader admin_user roles. Evidence is limited, so verification and remediation efforts are crucial.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact on TDengine Cloud DB instances, especially those with Data Reader admin_user roles.

Recommended defensive actions

• Verify TDengine Cloud DB instances for exposure to Data Reader admin_user roles
• Assess potential impact of create udf functionality on instances
• Update to version 3.4.1.15 or later if vulnerable
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the issue, but evidence is limited regarding actual exploitation or affected versions beyond 3.4.1.15. Defenders should verify exposure and assess potential impact on TDengine Cloud DB instances, especially those with Data Reader admin_user roles. The fix in version 3.4.1.15 should be applied. Limited evidence suggests prioritizing verification and remediation efforts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.