CVE-2026-9568: ThingsBoard YAML provision getGatewayDockerComposeFile code injection
A weakness has been identified in ThingsBoard up to 4.3.1.1. Affected by this vulnerability is the function getGatewayDockerComposeFile of the file /api/v1/provision of the component YAML Handler. This manipulation causes code injection. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The project was informed of the problem early through a pull request but has not reacted yet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Block or restrict access to the /api/v1/provision endpoint (and the getGatewayDockerComposeFile functionality) at the network edge (firewall, WAF, API gateway or ingress). Allow access only from trusted/internal IPs or networks and apply rate-limiting and request validation rules to reduce exposure to remote code-injection attempts.
- Operational
Audit access logs for requests to /api/v1/provision and the getGatewayDockerComposeFile function; investigate any suspicious or unexpected requests and isolate or remediate affected hosts if exploitation is suspected.
- Operational
Monitor the ThingsBoard project (issues/PRs) for an upstream fix for the code injection in getGatewayDockerComposeFile and plan to apply the vendor patch as soon as it is released.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9568?
The severity of CVE-2026-9568 is classified as medium with a score of 5.
How do I fix CVE-2026-9568?
To fix CVE-2026-9568, update ThingsBoard to version 4.3.1.2 or later.
What type of vulnerability is CVE-2026-9568?
CVE-2026-9568 is classified as a code injection vulnerability.
Can CVE-2026-9568 be exploited remotely?
Yes, CVE-2026-9568 can be exploited remotely.
What components of ThingsBoard are affected by CVE-2026-9568?
CVE-2026-9568 affects the function getGatewayDockerComposeFile within the YAML Handler of ThingsBoard.