LoginSign Up
← Back to all sparks
T

ThingsBoard

ANALYTICS
Velocity0.0

IoT platform for device management, data collection, processing and visualization

thingsboard.io ↗

An IoT platform whose release notes have become a CVE ledger

iotcve-remediationssrfrule-engineai-providersdual-branch
◆Current state
ThingsBoard ships every release twice — once on the 4.3 line and once as a 4.2 backport with an identical security section — and those security sections now dominate the notes, running to twenty or thirty CVEs per release. The recurring classes are telling: SSRF through AI model provider URLs, SSRF and file access escapes from the TBEL script sandbox, DNS rebinding bypasses, and access control on alarm comments. Feature work continues underneath, mostly IoT Hub integration and an Angular 20 UI migration.
◆Where it's heading
The platform is paying down the security cost of being extensible. TBEL scripting and user-configurable AI model endpoints are exactly the features that make ThingsBoard useful for industrial rule engines, and both are repeatedly the source of sandbox and SSRF findings — so the work has shifted to fencing them with allow-lists, opt-in SSRF protection and configurable security headers. Meanwhile the AI surface keeps growing, with structured output support spreading across more model providers.
◆Prediction
The dual-branch pattern will hold, with 4.2 continuing to receive the same security sets as 4.3 until it reaches end of life; expect further hardening of the TBEL sandbox rather than new scripting capability.

◆Recent moves

  1. 1mo ago

    4.3.1.3 clears 25+ CVEs and adds IoT Hub integration

    The largest single security batch in this window — four grouped fixes covering more than twenty-five CVEs plus CWE-426 and CWE-494 — shipped alongside IoT Hub integration and structured output support for additional AI model providers. The ratio of remediation to features is the story of this release line.

    View source ↗
  2. 1mo ago

    4.2.2.3 backports the full 4.3.1.3 security set

    The 4.2-line twin of 4.3.1.3, carrying an identical security section so operators who have not moved to 4.3 get the same CVE coverage. Confirms the project is treating 4.2 as fully supported rather than legacy.

    View source ↗
  3. 2mo ago

    4.3.1.2 fences the TBEL sandbox and AI provider URLs against SSRF

    Two fixes here matter more than the CVE count: SSRF through AI model provider URLs, and SSRF plus file access escapes from the TBEL script sandbox. Both are the extensibility surfaces the platform sells, which is why they keep needing fences rather than patches.

    View source ↗
  4. 2mo ago

    4.2.2.2 backports the TBEL sandbox and SSRF fixes

    The 4.2 twin of 4.3.1.2, with the same Jackson, TBEL sandbox and AI provider SSRF remediation. Same content, older branch.

    View source ↗
  5. 4mo ago

    4.3.1.1 adds configurable security headers and a rebinding allow-list

    Moves from patching individual findings to giving operators controls: configurable security headers, env-var-backed CORS, and an allow-list closing an SSRF DNS rebinding bypass. Also fixes an XSS in the notification center and upgrades to Spring Boot 3.5.

    View source ↗
  6. 4mo ago

    4.2.2.1 backports security headers and CORS configuration

    The 4.2 twin of 4.3.1.1, delivering the same configurable security headers, CORS handling and DNS rebinding allow-list to the older branch.

    View source ↗