EUVD-2026-44764Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Authenticated network access required (PR:L, AV:N); UDF creation yields limited but real integrity and confidentiality impact within unchanged scope.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a Data Reader admin_user on a TDengine Cloud DB instance could run create udf even though standard users should have read-only permissions for non-database objects and show dnodes and create user were denied. This issue is fixed in version 3.4.1.15.
AnalysisAI
Improper privilege management in TDengine Cloud DB prior to 3.4.1.15 allows an authenticated Data Reader admin_user to execute create udf (user-defined function) commands that should be restricted to higher-privilege roles. While the same role is correctly denied show dnodes and create user, the UDF creation permission was left ungated, creating a privilege escalation path within the database engine. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA KEV catalog.
Technical ContextAI
TDengine is an open-source time-series database purpose-built for IoT workloads. User-Defined Functions (UDFs) in TDengine allow loading and executing custom native-code functions within the query engine - a highly privileged capability, since malicious or poorly written UDFs can affect query results, access internal state, or cause instability. CWE-269 (Improper Privilege Management) is the root cause: the role-based access control (RBAC) model failed to consistently enforce read-only boundaries for the Data Reader admin_user role. The affected surface is TDengine Cloud DB instances, where the cloud-specific admin_user variant of the Data Reader role had its UDF ACL check omitted. Versions prior to 3.4.1.15 are affected according to the upstream GitHub Security Advisory GHSA-fmp7-rf4r-8q7p.
RemediationAI
Upgrade TDengine to version 3.4.1.15 or later, which resolves the missing ACL check on the create udf command for Data Reader admin_user accounts. The fix is confirmed by the vendor via GitHub Security Advisory GHSA-fmp7-rf4r-8q7p at https://github.com/taosdata/TDengine/security/advisories/GHSA-fmp7-rf4r-8q7p. As a compensating control prior to patching, audit all Data Reader admin_user accounts on TDengine Cloud DB instances and revoke or rotate credentials for any accounts that do not have a business need for that role. Additionally, review the information_schema.ins_user_privileges table (or equivalent) to identify any UDFs created by Data Reader accounts, and drop any that are unauthorized. There are no known side effects from upgrading to 3.4.1.15.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today