CVE-2026-62350 - TDengine: UDF lead to RCE

Back Back to CVE browser

HIGH

TDengine: UDF lead to RCE

Published Jul 15, 2026

7.2

HIGH

CVSS 3.1

EPSS 0.54%

Description

TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a user with create udf privilege could upload a crafted shared library and install it as a user-defined function, such as eval, then execute arbitrary C code on the TDengine server side through database queries. This issue is fixed in version 3.4.1.15.

Affected products

Vendor Taosdata Product TDengine Default
n/a
- Version
  < 3.4.1.15
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Taosdata

TDengine

n/a

Version	Status	Constraints
< 3.4.1.15	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44766
Advisory
https://github.com/taosdata/TDengine/security/advisories/GHSA-f7wh-p233-87xv
exploitx_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44766		Advisory
https://github.com/taosdata/TDengine/security/advisories/GHSA-f7wh-p233-87xv		exploitx_refsource_CONFIRM