Code Injection Vulnerability in ThingsBoard by ThingsBoard

CVE-2026-9568

What is CVE-2026-9568?

A code injection vulnerability has been discovered in ThingsBoard versions up to 4.3.1.1, specifically within the getGatewayDockerComposeFile function located in the /api/v1/provision endpoint of the YAML Handler component. This vulnerability enables attackers to perform remote code injection attacks, exploiting the system's functionality to execute arbitrary code. Although the threat is notable and has been acknowledged through community discussions, the vendor has yet to provide a remediation response despite early awareness of the issue via a pull request.

References