ThingsBoard vulnerabilities
We track 6 vulnerabilities in ThingsBoard products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on June 17, 2026.
Latest ThingsBoard vulnerabilities
- 8.6 High severity
ThingsBoard: Improperly Controlled Modification of Object Prototype Attributes
ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the affected product with the tenant administrator privilege (TENANT_ADMIN).
- 9.1 Critical severity
ThingsBoard: Server-Side Request Forgery
ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way tha
- 8.8 High severity
Thingsboard: Improper Neutralization of Special Elements in Output Used by a Downstream Component
ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint).
- 8.8 High severity
Thingsboard: Improper Privilege Management
An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers (CUSTOMER_USER) to gain escalated privileges (vertically) and become an Administrator (TENANT_ADMIN) or (SYS_ADMIN) on the web application. It is important to note that in order to a
- 8.1 High severity
Thingsboard: Use of Hard-coded Credentials
ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usable for privilege escalation) are stored in an insecure format. (To read this stored data, the attacker needs access to the application serve
- 8.8 High severity
Thingsboard: Improper Privilege Management
ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes parameter.