CVE-2026-62348 is a missing authorization vulnerability (CWE-862) in TDengine Enterprise before version 3.4.1.15. The vulnerability arises because the function mndProcessKillSsMigrateReq calls mndKillSsMigrate without enforcing the intended MND_OPER_SSMIGRATE_DB privilege check, which was commented out. This allows an authenticated user with low privileges to run the KILL SSMIGRATE <id> command against an active shared-storage migration, potentially disrupting migration operations. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) with network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact. The issue is resolved in TDengine version 3.4.1.15.

An authenticated low-privilege SQL user can interrupt active shared-storage migration processes by executing the KILL SSMIGRATE command without proper authorization. This can lead to denial of service or disruption of migration operations. There is no confidentiality impact reported. Integrity and availability impacts are limited but present.

Upgrade TDengine Enterprise to version 3.4.1.15 or later, where the missing authorization check has been restored and the vulnerability fixed. Patch status is not explicitly stated as 'official-fix' or 'patchAvailable' but the description confirms the issue is fixed in 3.4.1.15. No other mitigation or workaround is provided.