Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-62849: ThingLinks TDengine TDS APIs allow remote data tampering

CVE-2026-62849 · published 12 days ago

Summary

The TDengine TDS component in ThingLinks versions before 1.4.0 lets anyone send specially crafted requests that alter the time‑series data stored by the system. An attacker could add fake readings or change existing ones without logging in. Updating to version 1.4.0 removes this risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
mqttsnet	thinglinks	< 1.4.0

Original advisory text

ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows request-controlled JSON field values submitted to `/anyUser/tds/insertTableData` to reach unsafe SQL construction in the `TDS mapper`. A remote unauthenticated attacker can tamper with TDengine time-series data, including inserting unintended rows or overwriting existing readings. The affected surface is the TDS module's insert-table-data flow and TDengine mapper SQL generation. This issue is fixed in version 1.4.0.

References

https://github.com/mqttsnet/thinglinks/commit/60e7a934753638f916a665d2d24c437734... Patch
https://github.com/mqttsnet/thinglinks/releases/tag/v1.4.0 URL
https://github.com/mqttsnet/thinglinks/security/advisories/GHSA-gcj7-r5wv-348x Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62849... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-62849 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

9.1 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published30 Oct 2026

Updated10 Nov 2026

First seen30 Oct 2026

Sources

CVE-2026-62849 · NVD

CVE-2026-62849 · MITRE

CVE-2026-62849 · OSV

GHSA-gcj7-r5wv-348x · GHSA

Track software like this

Free during beta