LoginSign Up
← Back to all sparks
T

ThingsBoard

ANALYTICS
Velocity5.0

IoT platform for device management, data collection, processing and visualization

thingsboard.io ↗

ThingsBoard closes a script-sandbox file write and dozens of CVEs on its 4.3 and 4.2 lines.

iot platformsecurityrelease maintenanceltsiot hub
◆Current state
ThingsBoard keeps three lines patched in parallel: 4.4, 4.3.1 and the 4.2 LTS. On October 27, 4.3.1.8 and 4.2.2.8 shipped a large security batch: dozens of dependency CVEs, a fix for arbitrary file writes from the TBEL script sandbox, and tamper protection for the OAuth2 authorization cookie. They also fix partitions lost after a ZooKeeper session expiry and unbounded Kafka topic growth from RPC and REST replies, and add IoT Hub search and filter changes.
◆Where it's heading
After the 4.4 feature release the project is back to maintenance on all supported lines, mostly security and runtime fixes, with the IoT Hub catalogue getting steady UI work alongside. Feature work arrives in larger, infrequent releases.
◆Prediction
A matching 4.4.0.x patch with the same security batch is the likely next entry; 4.4 got no patch in this batch.

◆Recent moves

  1. 2d ago

    ThingsBoard 4.3.1.8 fixes TBEL sandbox file write and CVE batch

    Beyond a long CVE list, 4.3.1.8 fixes arbitrary file writes from the TBEL script sandbox, protects the OAuth2 request cookie, and stops partition loss after ZooKeeper expiry and runaway Kafka reply topics. It is a heavier maintenance release than the time zone patches of a week ago and worth applying promptly.

    View source ↗
  2. 2d ago

    ThingsBoard 4.2.2.8: LTS security backport

    The 4.2 LTS line gets the same security batch, sandbox fix and Kafka/ZooKeeper fixes as 4.3.1.8. It keeps the three supported lines in step.

    View source ↗
  3. 7d ago

    ThingsBoard 4.4.0.1: 2026 time zone data update

    The first 4.4 patch updates time zone data in Java, Node.js and the UI for 2026 daylight saving changes. Routine maintenance on the new line.

    View source ↗
  4. 7d ago

    ThingsBoard 4.3.1.7: 2026 time zone data update

    4.3.1.7 gets the same time zone data refresh.

    View source ↗
  5. 7d ago

    ThingsBoard 4.2.2.7: 2026 time zone data update

    The 4.2 LTS line gets the same time zone update, keeping all three lines in step.

    View source ↗
  6. 1mo ago

    ThingsBoard 4.4 Release

    4.4 is the first feature release in months after a long run of patch-only builds: Java 25, a redesigned sidebar/toolbar, remote agents, WebSocket API-key auth, Kafka OAuth2, and customer-level reporting. It broadens the platform in many small directions rather than one directional change.

    View source ↗