CVE-2026-62348

TDengine: KILL SSMIGRATE missing authorization lets low-privilege users interrupt shared-storage migrations

Published Jul 15, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Description

TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, TDengine Enterprise allowed an authenticated low-privilege SQL user to run KILL SSMIGRATE <id> against an active shared-storage migration because mndProcessKillSsMigrateReq called mndKillSsMigrate while the intended MND_OPER_SSMIGRATE_DB privilege check was commented out. This issue is fixed in version 3.4.1.15.

Analysis

Technical impact

A missing authorization check in TDengine Enterprise allowed an authenticated user with low privileges to execute the KILL SSMIGRATE <id> command against an active shared‑storage migration. The flaw originates from the mndProcessKillSsMigrateReq routine calling mndKillSsMigrate without enforcing the intended MND_OPER_SSMIGRATE_DB privilege. As a result, a malicious actor can terminate an ongoing migration, potentially leading to data inconsistency or loss of work and interrupting critical operations. The vulnerability is a privilege‑escalation‑to‑denial‑of‑service flaw (CWE‑862).

Affected Systems

The affected product is taosdata TDengine, all releases prior to version 3.4.1.15. The issue is fixed in 3.4.1.15 and later releases.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at the time of reporting. The vulnerability is not listed in CISA KEV. Attack likely requires the attacker to log in to the database and issue the KILL SSMIGRATE command, implying a network or local access to the database with low‑privilege credentials as the attack vector.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

taosdata

TDengine

affected

Version	Status	Constraints
`< 3.4.1.15`	affected	—

No data.

Vendor Product Versions

Taosdata

Tdengine

Version	Status	Scheme	Platform
`[0,3.4.1.15)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Deploy TDengine 3.4.1.15 or later to apply the vendor patch that restores the proper privilege check.
Ensure that only authorized administrative accounts have the MND_OPER_SSMIGRATE_DB privilege; audit privilege assignments to limit the set of users who can execute migration‑termination commands.
Monitor database logs for unexpected KILL SSMIGRATE activity and validate that migrations complete normally; if the patch cannot be applied immediately, disable shared‑storage migrations until remediation is performed.

Generated by OpenCVE AI on July 31, 2026 at 03:02 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.252% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/taosdata/TDengine/security/advisories/GHSA-67g2-ffwr-7x9h

History

Jul 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 15, 2026 10:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Taosdata Taosdata tdengine
Vendors & Products		Taosdata Taosdata tdengine

Jul 15, 2026 7:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, TDengine Enterprise allowed an authenticated low-privilege SQL user to run KILL SSMIGRATE <id> against an active shared-storage migration because mndProcessKillSsMigrateReq called mndKillSsMigrate while the intended MND_OPER_SSMIGRATE_DB privilege check was commented out. This issue is fixed in version 3.4.1.15.
Title		TDengine: KILL SSMIGRATE missing authorization lets low-privilege users interrupt shared-storage migrations
Weaknesses		CWE-862
References		https://github.com/taosdata/TDengine/security/advisories/GHSA-67g2-ffwr-7x9h
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}`