ThingsBoard vulnerabilities
5 known CVE vulnerabilities in ThingsBoard, translated and rated.
- CVE-2026-36537Critical
ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint.
- CVE-2025-34282Critical
An SSRF vulnerability in the Image Upload Gallery feature of ThingsBoard versions prior to 4.2.1 allows an attacker to upload a malicious SVG file referencing a remote URL. Server processing may trigger unintended outbound requests.
- CVE-2026-53676High
ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the affected product with the tenant administrator privilege (TENANT_ADMIN).
- CVE-2026-9568Medium
In ThingsBoard up to version 4.3.1.1, a vulnerability in the getGatewayDockerComposeFile function of /api/v1/provision (YAML Handler component) allows code injection. Remote attack is possible but difficult.
- CVE-2022-45608High
An issue in ThingsBoard 3.4.1 allows low-privileged attackers (CUSTOMER_USER) to escalate privileges to administrator level (TENANT_ADMIN or SYS_ADMIN). The attack requires knowledge of the corresponding API parameter (authority: value).