Reading the 2026 ThingsBoard CVE List: One Platform Flaw, Eleven From Dependencies

WZ-IT operates thingshost. Current hosting starts from €159.80 net/month; setup and service level follow the proposal. Former package prices, location lists and cost comparisons in this dated article describe the previous offer, not current WZ-IT terms. View current service scope.

Point a vulnerability scanner at a ThingsBoard installation and 2026 produces an uncomfortably long list. Checking eleven frequently cited identifiers against NVD, however, left exactly one that concerns ThingsBoard itself: CVE-2026-53676. The other ten sit in Spring, pgjdbc, Apache OpenNLP, Netty and Apache Tomcat, meaning in libraries the platform ships. This distinction is not pedantry; it determines who can patch and when. This article sorts the list and draws the operational consequences.

Also of interest: NIS2 for OT and IIoT platforms · ThingsBoard CE vs PE 2026 · ThingsBoard: cloud or managed hosting?

Table of Contents

• The one that counts: CVE-2026-53676
  • How bad is it?
• And the other ten?
• Why the distinction determines the path of action
• A procedure for scanner findings
• What this means for operational planning
• thingshost: managed ThingsBoard from Germany
• Conclusion
• Sources

The one that counts: CVE-2026-53676

ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context, by a user who can log in to the affected product with tenant administrator privileges [1].

The hard data from NVD [1]:

Per the JVN advisory, all versions before 4.3.1.2 are affected [2]. The vulnerability was reported by Hiroki Imai of LAC Co., Ltd. to IPA, with coordination through JPCERT/CC [2]. The fix is titled "Hardened remote JS executor script invocation" in ThingsBoard [2][3].

How bad is it?

Precision pays here, because the two CVSS values diverge and both are right.

The precondition is substantial: the attacker must already be able to log in with tenant administrator privileges. This is not anonymous exploitation over the internet but privilege escalation from an already highly privileged account.

It becomes relevant nonetheless, wherever tenants are not administered exclusively by the platform operator. Anyone giving customers or business units their own tenants with their own administrators has precisely the configuration in which the sandbox is meant to be the separating element. A flaw in that sandbox is then not an academic problem.

And the other ten?

The list aggregators file under ThingsBoard looks considerably more threatening than it is. Checked against NVD, the picture is this [4]:

Ten of eleven checked identifiers therefore concern third-party components. This is not a criticism of ThingsBoard: a Java platform of this size inevitably ships Spring, Netty, Tomcat and a JDBC driver, and each of those has its own stream of vulnerabilities.

One detail deserves attention: CVE-2026-43512 is marked DEPRECATED in NVD [4]. Carrying that identifier in a report as an open critical flaw means carrying a dead entry.

Why the distinction determines the path of action

This is the actual point of this article, and it applies well beyond ThingsBoard.

With a platform flaw the path is clear: the project ships a release, you upgrade. For CVE-2026-53676 that is version 4.3.1.2 [2].

With a dependency flaw the path is longer. The library publishes a fix. ThingsBoard then has to pull in the new version, test it and build a release. Only then can you upgrade. Between the publication of the Netty issues on 13 May and a ThingsBoard release containing the new Netty version, time necessarily passes.

During that time the following happens: your scanner reports the identifier. There is no patch you could apply. And the question you then get asked is not "is this fixed" but "why has this been open for six weeks".

The honest answer is rarely satisfying, but it matters: an operator cannot close a dependency flaw before the project pulls it in. They can constrain, restrict or disable the affected path. They cannot patch it.

A procedure for scanner findings

Three steps that remove most of the noise.

1. Check against NVD, not an aggregator. The attribution "this is a ThingsBoard CVE" often comes from a dependency relationship rather than from the vulnerability itself. The NVD entry names the component actually affected. For the list above, that was the difference between eleven and one.

2. Platform or dependency? This determines whether a ThingsBoard release is the answer or whether you are waiting for one.

3. Is the path reachable in your installation? Apache OpenNLP at 9.8 is impressive on paper but only relevant if the affected function is used. CVE-2026-53676 at 8.6 requires a tenant administrator account. CVSS describes technical severity, not your exposure.

Only after these three steps can the urgency question be answered sensibly. Skipping them means patching in the wrong order, or not at all because the list looks too long to start.

What this means for operational planning

For ThingsBoard specifically:

• Follow the current release branch instead of sitting on one version. Updated dependencies only arrive through releases, and anyone three versions behind accumulates dependency CVEs without having done anything wrong themselves.
• Treat tenant administrator accounts as privileged accounts. CVE-2026-53676 is a reminder that this role can do a great deal in ThingsBoard and that the sandbox is the boundary, not the role assignment.
• Use the release table as your source, not the scanner report [5].
• When reporting to management, include the distinction. A list of eleven entries and a list of one platform flaw plus ten dependencies lead to different decisions.

How this fits into the requirements from NIS2 we covered in our article on NIS2 for OT and IIoT platforms. In short: vulnerability handling is a named obligation there, and a traceable procedure counts for more than an empty list.

thingshost: managed ThingsBoard from Germany

We run ThingsBoard as a dedicated instance, in Germany by default, with a data processing agreement. We perform updates with notice and a maintenance window, including the release changes through which updated dependencies arrive.

The Standard plan with the Community Edition starts at EUR 149.90 net per month in the Germany region, recommended up to 100 devices and with no licence-imposed device limit.

What we cannot do and do not claim: close a dependency flaw before ThingsBoard pulls it into a release. What we do is assess the affected path, constrain it where possible, and tell you, rather than letting you learn the identifier from a scanner report.

The trial runs 7 days. A credit card is required to sign up, and after it expires the trial converts automatically into the chosen paid subscription.

See pricing · Get in touch

Conclusion

The 2026 ThingsBoard CVE situation is quieter than the lists suggest. One platform vulnerability, CVE-2026-53676, fixed from version 4.3.1.2, with a precondition that makes it serious in multi-tenant environments and manageable in single-operator ones.

The rest is the ordinary vulnerability stream of a Java stack. It does not go away, it cannot be avoided by choosing a different vendor, and adding up CVSS scores does not make it easier to understand. What helps is the distinction: who can patch, who has to wait, and whether the affected path is reachable in your installation at all.

thingshost is an independent managed hosting provider and is not affiliated with ThingsBoard, Inc., the Apache Software Foundation, Broadcom or the Netty project contributors. CVE details follow the National Vulnerability Database as of 5 September 2026; scores and attributions can change. This article provides technical context and does not constitute security advice.

Sources

• [[1]] NVD: CVE-2026-53676 – prototype pollution in ThingsBoard, CVSS 4.0 8.6 / CVSS 3.0 7.2, published 17 June 2026, requires TENANT_ADMIN
• [[2]] JVN JVN16937365 – versions before 4.3.1.2 affected, reported by Hiroki Imai (LAC Co., Ltd.), coordinated by JPCERT/CC
• [[3]] thingsboard/thingsboard · pull request #15600 – "Hardened remote JS executor script invocation"
• [[4]] National Vulnerability Database – search interface for the identifiers checked (Spring, pgjdbc, Apache OpenNLP, Netty, Apache Tomcat)
• [[5]] ThingsBoard release table – official version overview
• thingshost.de – managed ThingsBoard hosting