Is there a patch available for EUVD-2026-31957?

Yes, a patch is available for EUVD-2026-31957. Update the affected software to the latest version immediately.

ThingsBoard EUVD-2026-31957

Q: What is the CVSS score of EUVD-2026-31957?

EUVD-2026-31957 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-9568 LOW

Code Injection (CWE-94)

2026-05-26 VulDB

GHSA-96jf-2v3w-hrrp

Code Injection RCE Thingsboard

2.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 13:38 vuln.today

Analysis Generated

Jun 08, 2026 - 13:38 vuln.today

Severity Changed

May 26, 2026 - 19:22 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 19:22 NVD

5.0 (MEDIUM) 2.3 (LOW)

DescriptionCVE.org

A weakness has been identified in ThingsBoard up to 4.3.1.1. Affected by this vulnerability is the function getGatewayDockerComposeFile of the file /api/v1/provision of the component YAML Handler. This manipulation causes code injection. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The project was informed of the problem early through a pull request but has not reacted yet.

AnalysisAI

Code injection in ThingsBoard 4.3.1.0 and 4.3.1.1 allows remote attackers to embed control characters and shell metacharacters into server-generated Docker Compose YAML files and MQTT publish commands via the /api/v1/provision endpoint's getGatewayDockerComposeFile and getMqttPublishCommand functions. Device credential fields - including clientId, userName, password, and credentialsId - are passed unsanitized into YAML and shell command construction, enabling injection of shell special characters such as $, backtick, and double-quote. No public exploit has been identified at time of analysis; SSVC rates exploitation as none and EPSS is 0.04%, though the RCE tag warrants scrutiny given the CVSS 4.0 score of only 2.3.

Technical ContextAI

ThingsBoard is an open-source IoT platform for device management and data processing. The vulnerable functions reside in DeviceConnectivityUtil.java: getGatewayDockerComposeFile() programmatically constructs a Docker Compose YAML file embedding the gateway host value and credential data, while getMqttPublishCommand() builds shell-formatted MQTT client commands using credential fields inserted inside double-quoted shell arguments. Neither function sanitized its inputs prior to the fix. The root cause is CWE-94 (Code Injection): control characters (0x00-0x1F, 0x7F) can corrupt YAML structure by introducing unexpected line breaks or null bytes, while shell metacharacters - $, backtick, backslash, double-quote - embedded in double-quoted shell arguments enable variable expansion or command substitution. The PR #15550 fix adds a CONTROL_CHARS regex pattern, a containsControlChars() validator that rejects malicious credentials at storage time, a stripControlChars() sanitizer for YAML output, and an escapeShellArg() function that escapes all four shell-dangerous characters before interpolation into command strings. The CPE string cpe:2.3:a:n/a:thingsboard:*:*:*:*:*:*:*:* uses an n/a vendor namespace, indicating incomplete NVD CPE assignment.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed. The fix is available as GitHub PR #15550 (https://github.com/thingsboard/thingsboard/pull/15550), which adds input validation rejecting control characters in device credentials and escapes shell metacharacters before command interpolation. However, as the ThingsBoard maintainers had not merged this PR at time of reporting, no official patched release version can be cited. Organizations should monitor the ThingsBoard GitHub repository (https://github.com/thingsboard/thingsboard/) for a release incorporating these changes and apply it promptly. As a compensating control, restrict network-level access to the /api/v1/provision endpoint to trusted IP ranges at the API gateway or firewall layer - note this will break unauthenticated device provisioning flows if those are in use. Additionally, enforce input validation on device credential fields (clientId, userName, password, credentialsId) at the ingestion boundary to reject control characters (0x00-0x1F, 0x7F) and shell metacharacters. If the gateway Docker Compose generation feature is not operationally required, blocking the specific endpoint sub-path reduces attack surface with no functional trade-off for deployments not using ThingsBoard IoT gateways.