CVE-2026-9568: ThingsBoard YAML provision getGatewayDockerComposeFile code injection

Severity: medium (CVSS 5.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-26 · updated 2026-07-23
Weakness: CWE-74

Description

A weakness has been identified in ThingsBoard up to 4.3.1.1. Affected by this vulnerability is the function getGatewayDockerComposeFile of the file /api/v1/provision of the component YAML Handler. This manipulation causes code injection. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The project was informed of the problem early through a pull request but has not reacted yet.

Affected products

ThingsBoard: 4.3.1.0, 4.3.1.1

References

https://github.com/thingsboard/thingsboard/
https://github.com/thingsboard/thingsboard/pull/15550
https://vuldb.com/submit/817064
https://vuldb.com/vuln/365630
https://vuldb.com/vuln/365630/cti

Get alerted when CVE-2026-9568 or the next vulnerability affects your stack