Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
Thingsboard Java client may send data to wrong Kafka topics
published 5 days ago
Summary
The Java component that Thingsboard uses to talk to Apache Kafka can sometimes mix up where messages go because of a timing issue. This could cause data to appear in the wrong place without any alert, leading to confusion or inaccurate reporting. Update Thingsboard to the latest version that includes the fix or apply the vendor’s recommended patch.
What to do
- Update cleanstart thingsboard to version 4.3.1-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | thingsboard |
< 4.3.1-r0 Fix: upgrade to 4.3.1-r0
|
Original advisory text
race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics
Security vulnerability affects the thingsboard package. A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-PE29721 · OSV
Track software like this
Free during beta