LoginSign Up
← Back to all sparks
T

ThingsBoard

ANALYTICS
Velocity5.0

IoT platform for device management, data collection, processing and visualization

thingsboard.io ↗

ThingsBoard closes a script-sandbox file write and dozens of CVEs on its 4.3 and 4.2 lines.

iot platformsecurityrelease maintenanceltsiot hub
◆Current state
ThingsBoard keeps three lines patched in parallel: 4.4, 4.3.1 and the 4.2 LTS. On October 27, 4.3.1.8 and 4.2.2.8 shipped a large security batch, including a fix for arbitrary file writes from the TBEL script sandbox and tamper protection for the OAuth2 authorization cookie. On October 30, 4.4.0.2 followed with security patches, though its notes list no details.
◆Where it's heading
After the 4.4 feature release the project is back to maintenance on all supported lines, mostly security and runtime fixes, with the IoT Hub catalogue getting steady UI work alongside. Feature work arrives in larger, infrequent releases.
◆Prediction
Expect the next entries to be routine patches across all three lines. The notes do not say whether 4.4.0.2 carries the same fixes as the 4.3 batch.

◆Recent moves

  1. 10d ago

    ThingsBoard 4.4.0.2: security patches, no details listed

    The 4.4 line gets its own security patch three days after 4.3 and 4.2, but the notes give no details.

    View source ↗
  2. 13d ago

    ThingsBoard 4.3.1.8 fixes TBEL sandbox file write and CVE batch

    Beyond a long CVE list, 4.3.1.8 fixes arbitrary file writes from the TBEL script sandbox, protects the OAuth2 request cookie, and stops partition loss after ZooKeeper expiry and runaway Kafka reply topics. It is a heavier maintenance release than the time zone patches of a week ago and worth applying promptly.

    View source ↗
  3. 13d ago

    ThingsBoard 4.2.2.8: LTS security backport

    The 4.2 LTS line gets the same security batch, sandbox fix and Kafka/ZooKeeper fixes as 4.3.1.8. It keeps the three supported lines in step.

    View source ↗
  4. 18d ago

    ThingsBoard 4.4.0.1: 2026 time zone data update

    The first 4.4 patch updates time zone data in Java, Node.js and the UI for 2026 daylight saving changes. Routine maintenance on the new line.

    View source ↗
  5. 18d ago

    ThingsBoard 4.3.1.7: 2026 time zone data update

    4.3.1.7 gets the same time zone data refresh.

    View source ↗
  6. 18d ago

    ThingsBoard 4.2.2.7: 2026 time zone data update

    The 4.2 LTS line gets the same time zone update, keeping all three lines in step.

    View source ↗