CVE-2026-62350: TDengine: UDF lead to RCE

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-15 · updated 2026-10-24
Weakness: CWE-94

Description

TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a user with create udf privilege could upload a crafted shared library and install it as a user-defined function, such as eval, then execute arbitrary C code on the TDengine server side through database queries. This issue is fixed in version 3.4.1.15.

Affected products

taosdata TDengine: before 3.4.1.15

References

https://github.com/taosdata/TDengine/security/advisories/GHSA-f7wh-p233-87xv
https://github.com/taosdata/TDengine/security/advisories/GHSA-f7wh-p233-87xv

Get alerted when CVE-2026-62350 or the next vulnerability affects your stack