PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9568 ThingsBoard CVE debrief

A code injection vulnerability exists in ThingsBoard versions up to 4.3.1.1, specifically within the `getGatewayDockerComposeFile` function accessible via the `/api/v1/provision` endpoint. The vulnerability stems from improper handling of YAML input, allowing an attacker to inject and execute arbitrary code. The attack vector is network-based but requires high complexity and user interaction, resulting in a LOW severity CVSS 4.0 score of 2.3. The vulnerability was disclosed to the project maintainers via GitHub pull request #15550 prior to public disclosure, though no official response or patch has been released as of the CVE publication date of May 26, 2026.

Vendor
ThingsBoard
Product
ThingsBoard
CVSS
LOW 2.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-07-23
Advisory published
2026-05-26
Advisory updated
2026-07-23

Who should care

Organizations running ThingsBoard instances with exposed provision APIs, particularly those using gateway provisioning features. Security teams monitoring for unpatched vulnerabilities in IoT platform infrastructure. Developers and administrators responsible for ThingsBoard deployment security.

Technical summary

The vulnerability resides in the `getGatewayDockerComposeFile` function within ThingsBoard's provision API (`/api/v1/provision`). Insufficient input validation on YAML processing enables code injection. The attack requires network access but is mitigated by high complexity and required user interaction. No authentication requirements are specified in available data. The vulnerability affects versions up to and including 4.3.1.1.

Defensive priority

LOW

Recommended defensive actions

  • Review and restrict access to the `/api/v1/provision` endpoint, implementing network segmentation or access controls where possible
  • Monitor for unusual activity targeting the provision API endpoint, particularly requests attempting YAML payload manipulation
  • Await official patch from ThingsBoard maintainers; verify PR #15550 status for potential community or unofficial fixes
  • Implement input validation and sanitization for YAML processing functions, following secure coding practices for YAML parsers
  • Consider disabling or restricting gateway provisioning functionality if not required for operations until a patch is available

Evidence notes

The vulnerability description identifies the affected component as the YAML Handler in the `getGatewayDockerComposeFile` function at `/api/v1/provision`. The CVSS 4.0 vector indicates network attack vector (AV:N), high attack complexity (AC:H), no attacker privileges required (PR:N), and user interaction required (UI:P). CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-94 (Improper Control of Generation of Code) are identified as the underlying weaknesses. The NVD status is listed as 'Deferred'.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9568 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9568

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9568 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9568

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.