CVE-2026-62355

TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a Data Reader admin_user on a TDengine Cloud DB instance could run create udf even though standard users should have read-only permissions for non-database objects and show dnodes and create user were denied. This issue is fixed in version 3.4.1.15.

• CWE-269

• https://github.com/taosdata/TDengine/security/advisories/GHSA-fmp7-rf4r-8q7p

Published

Jul 15, 2026

Last Modified

Jul 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62349TDengine is an open source, time-series database optimized f…8.3
• CVE-2026-6235The Sendmachine for WordPress plugin for WordPress is vulner…9.8
• CVE-2026-62350TDengine is an open source, time-series database optimized f…7.2
• CVE-2026-62351TDengine is a time-series database optimized for Internet of…7.5
• CVE-2026-62353TDengine is a time-series database optimized for Internet of…5.4
• CVE-2026-62354Authorization handling for Parameter Context validation requ…4.3
• CVE-2026-6236The Posts map plugin for WordPress is vulnerable to Stored C…6.4
• CVE-2026-62361listmonk is a standalone, self-hosted, newsletter and mailin…5.5
• CVE-2026-62363ImageMagick is free and open-source software used for editin…5
• CVE-2026-6237The Quick Table plugin for WordPress is vulnerable to Stored…6.4
• CVE-2026-62378RustFS Console is a web management console for the RustFS di…9
• CVE-2026-6238The deprecated functions ns_printrrf, ns_printrr and fp_nque…6.5