TDengine EUVD-2026-44764

Exploitation requires a valid Data Reader admin_user account on a TDengine Cloud DB instance running a version prior to 3.4.1.15. The attacker must be able to authenticate to the database over the network (AV:N, PR:L). The vulnerability is specific to the cloud deployment mode - the advisory does not indicate that self-hosted or on-premises TDengine instances are affected in the same way. Exploitation is limited by the requirement for prior authentication: unauthenticated attackers cannot reach the vulnerable code path. The specific triggering action is issuing a create udf SQL statement, which the server incorrectly permits for this role. Note that show dnodes and create user are correctly denied to this role, so the ACL bypass is narrowly scoped to UDF creation.

The CVSS 3.1 score of 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N accurately reflects the bounded risk: exploitation requires authenticated low-privilege access (PR:L), limiting the attacker pool to existing Data Reader credential holders. The unchanged scope (S:U) and low C/I ratings are consistent with the described impact being confined to the database layer. No EPSS data was provided in the input, KEV status is negative, and no POC code has been identified - all of which reduce urgency relative to the raw CVSS score. The primary real-world concern is that UDF creation is not a benign capability: a malicious insider or compromised Data Reader account could use it to introduce code that manipulates query output or exfiltrates data, making the C:L/I:L impact potentially understated in high-sensitivity IoT data environments. However, without KEV listing or public exploit code, this is a low-urgency patch priority for most organizations.

An attacker who has obtained Data Reader credentials for a TDengine Cloud DB instance - whether through phishing, credential stuffing, or insider access - connects to the database over the network and issues a create udf statement to load a custom function. Because the ACL check is absent for this command in the affected versions, the command succeeds despite the read-only role, allowing the attacker to introduce a UDF that may manipulate query results or access data outside their intended scope. No public exploit code exists at time of analysis.