EUVD-2026-44769Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
PR:L confirmed by low-privilege SQL user requirement; I:L and A:L reflect migration disruption without data exposure or full system compromise; no scope change as impact is confined to the database service.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, TDengine Enterprise allowed an authenticated low-privilege SQL user to run KILL SSMIGRATE <id> against an active shared-storage migration because mndProcessKillSsMigrateReq called mndKillSsMigrate while the intended MND_OPER_SSMIGRATE_DB privilege check was commented out. This issue is fixed in version 3.4.1.15.
AnalysisAI
Privilege escalation in TDengine Enterprise (prior to 3.4.1.15) allows any authenticated low-privilege SQL user to abort active shared-storage migrations by issuing KILL SSMIGRATE commands that should be restricted to administrators. The MND_OPER_SSMIGRATE_DB privilege gate was inadvertently commented out in mndProcessKillSsMigrateReq, collapsing authorization enforcement entirely for this operation. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available in version 3.4.1.15.
Technical ContextAI
TDengine is a time-series database engine optimized for IoT workloads and offered in open-source and Enterprise editions. The affected component is the Management Node Daemon (MND), specifically the function mndProcessKillSsMigrateReq, which processes requests to terminate shared-storage (SS) migration jobs. CWE-862 (Missing Authorization) identifies the root cause: the intended privilege check MND_OPER_SSMIGRATE_DB - which should gate the KILL SSMIGRATE command to authorized administrators - was commented out in code, allowing the operation to proceed for any authenticated SQL session regardless of actual permission level. The CVSS vector AV:N/AC:L/PR:L/UI:N confirms the attack path is network-reachable with no elevated privileges required beyond a basic database credential.
RemediationAI
Upgrade TDengine Enterprise to version 3.4.1.15 or later, which restores the MND_OPER_SSMIGRATE_DB privilege check in mndProcessKillSsMigrateReq. The vendor advisory is at https://github.com/taosdata/TDengine/security/advisories/GHSA-67g2-ffwr-7x9h. If immediate patching is not feasible, restrict database access so that only trusted, higher-privilege accounts can authenticate to TDengine Enterprise, reducing the pool of users who could abuse this endpoint. Additionally, schedule critical shared-storage migrations during controlled windows when only authorized administrators hold active sessions. Network-level controls are not an effective compensating control here, as exploitation requires legitimate authenticated SQL access rather than a distinct network protocol or port that could be filtered independently.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today