CVE-2026-9568ThingsBoard YAML provision getGatewayDockerComposeFile code injection
- 2.3LowCVSS base score
- 0.22%Exploitation in 30 daysEPSS · top 87% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
A weakness has been identified in ThingsBoard up to 4.3.1.1. Affected by this vulnerability is the function getGatewayDockerComposeFile of the file /api/v1/provision of the component YAML Handler. This manipulation causes code injection. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The project was informed of the problem early through a pull request but has not reacted yet.
Timeline
ID reserved
By VulDB
Published
- 1 day later
· 1 day later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| VulDBCNA (assigner) | 4.0 | Low2.3 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X |
| VulDBCNA (assigner) | 3.1 | Medium5.0 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R |
| VulDBCNA (assigner) | 3.0 | Medium5.0 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R |
| VulDBCNA (assigner) | 2.0 | Medium5.1 | AV:N/AC:H/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:UR |
| NVDNVD · Deferred | 4.0 | Low2.3 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.22% · top 87% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.3.
Affected products
ThingsBoard
- affected 4.3.1.0
- affected 4.3.1.1
References
References5
- VDB-365630 | ThingsBoard YAML provision getGatewayDockerComposeFile code injection (opens in a new tab)vdb-entrytechnical-description
- VDB-365630 | CTI Indicators (IOB, IOC, TTP, IOA) (opens in a new tab)signaturepermissions-required
- Submit #817064 | ThingsBoard ThingsBoard Community Edition 3.6.2 through 4.3.1.1 Code Injection (opens in a new tab)third-party-advisory
- https://github.com/thingsboard/thingsboard/pull/15550 (opens in a new tab)issue-trackingpatch
- https://github.com/thingsboard/thingsboard/ (opens in a new tab)product
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-31957 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-9568)Record last updated .