SECURITYCRITICALCVE-2026-62849

CVE-2026-62849: ThingLinks Unauthenticated SQL Injection in TDengine TDS APIs

ThingLinks before 1.4.0 allows unauthenticated SQL injection via the TDengine TDS insertTableData endpoint (CVSS 9.1).

Dylan H.

Security Team

October 31, 2026
1 min read
CVE-2026-62849: ThingLinks Unauthenticated SQL Injection in TDengine TDS APIs

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • ThingLinks versions before 1.4.0

Summary

CVE-2026-62849 is an unauthenticated SQL injection in ThingLinks, an enterprise IoT platform. It was published to the NVD on October 30, 2026 with a CVSS score of 9.1.

Details

In versions before 1.4.0, request-controlled JSON field values submitted to /anyUser/tds/insertTableData (part of the TDengine TDS APIs) reach unsafe SQL construction in the TDS mapper. A remote, unauthenticated attacker can therefore inject SQL into the backing time-series database.

ItemValue
CVECVE-2026-62849
CVSS9.1
VectorNetwork, no authentication
AffectedThingLinks before 1.4.0
FixedThingLinks 1.4.0

Impact

Depending on the database privileges in use, an attacker may be able to read, alter or delete IoT telemetry and related data held in the TDengine store.

Remediation

  1. Upgrade ThingLinks to 1.4.0 or later.
  2. Until patched, block external access to /anyUser/tds/ paths at the reverse proxy or WAF, and keep the platform off the public internet.
  3. Review access logs for unusual requests to /anyUser/tds/insertTableData.
  4. Run the database account with least privilege.

References