CVE-2026-62849
ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the TDengine TDS APIs allows request-controlled JSON field values submitted to /anyUser/tds/insertTableData to reach unsafe SQL construction in the TDS mapper. A remote unauthenticated attacker can tamper with TDengine time-series data, including inserting unintended rows or overwriting existing readings. The affected surface is the TDS module's insert-table-data flow and TDengine mapper SQL generation. This issue is fixed in version 1.4.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the TDengine TDS APIs allows request-controlled JSON field values submitted to /anyUser/tds/insertTableData to reach unsafe SQL construction in the TDS mapper. A remote unauthenticated attacker can tamper with TDengine time-series data, including inserting unintended rows or overwriting existing readings. The affected surface is the TDS module's insert-table-data flow and TDengine mapper SQL generation. This issue is fixed in version 1.4.0.
- Record
CVE-2026-62849- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2026-114457
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the TDengine TDS APIs allows request-controlled JSON field values submitted to /anyUser/tds/insertTableData to reach unsafe SQL construction in the TDS mapper. A remote unauthenticated attacker can tamper with TDengine time-series data, including inserting unintended rows or overwriting existing readings. The affected surface is the TDS module's insert-table-data flow and TDengine mapper SQL generation. This issue is fixed in version 1.4.0.
- Record
EUVD-2026-114457- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
NVD
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the TDengine TDS APIs allows request-controlled JSON field values submitted to /anyUser/tds/insertTableData to reach unsafe SQL construction in the TDS mapper. A remote unauthenticated attacker can tamper with TDengine time-series data, including inserting unintended rows or overwriting existing readings. The affected surface is the TDS module's insert-table-data flow and TDengine mapper SQL generation. This issue is fixed in version 1.4.0.
- Record
CVE-2026-62849- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-03
OSV
ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the TDengine TDS APIs allows request-controlled JSON field values submitted to /anyUser/tds/insertTableData to reach unsafe SQL construction in the TDS mapper. A remote unauthenticated attacker can tamper with TDengine time-series data, including inserting unintended rows or overwriting existing readings. The affected surface is the TDS module's insert-table-data flow and TDengine mapper SQL generation. This issue is fixed in version 1.4.0.
- Record
CVE-2026-62849- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-04
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | NVD, OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-62849 is a critical vulnerability (CVSS 9.1) in Mqttsnet Thinglinks, published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 42nd percentile. No source names a fixed version.
References
github.com/mqttsnet/thinglinks/security/advisories/GHSA-gcj7-r5wv-348x
nvd.nist.gov/vuln/detail/CVE-2026-62849