mqttsnet thinglinks, CVE-2026-62853: a new CVE scored 9.9

The bottom line

If you run ThingLinks, update to 1.4.0 this week and first find out who can log in to it. If you do not run ThingLinks, you can stop reading.

Free analysis report · 9 pagesmqttsnet thinglinks, CVE-2026-62853: a new CVE scored 9.9The same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Does this apply to you?

What it is

A logged-in user of ThingLinks can send their own Groovy code to the rule engine's script test endpoint. The server compiles and runs it with no sandbox, so the attacker can run any code on the server.

Why it matters

The score is 9.9. The vendor's advisory says the attacker needs only a low-privilege login, over the network, with no user interaction. The 'scope changed' rating means a hit can reach beyond ThingLinks itself. Our reading is that a server running attacker code can expose device data and the network behind it. The same release also fixes CVE-2026-62849, so update once for both.

What the vendor's advisory says

We read two pages on github.com. In short:

• The vendor's advisory was published 27 June 2026 and rates the flaw Critical, 9.9. It lists CWE-78 and CWE-94.
• The advisory names the affected package as thinglinks-rule and says versions below 1.4.0 are affected; 1.4.0 is the patched version.
• The release notes for 1.4.0 (22 July 2026) say the fix removes externally reachable test controllers and limits dynamic execution to internal service calls.
• The same release fixes CVE-2026-62849, an unauthenticated SQL injection in the TDengine TDS APIs.
• The release also moves the shared thinglinks-parent and thinglinks-util dependency line to 1.0.8.3 and replaces bundled credentials with placeholders.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• "It needs a login, so it is not urgent." The record says a low-privilege login is enough, and the vendor rates it 9.9. Any account that can reach the endpoint is a route in.
• "Not on the CISA list, so nobody is using it." CISA's list did not include it when read. That says nothing about whether anyone is trying it.
• "The earlier ThingLinks fix covers it." The vendor names 1.4.0 as the fixed version for this flaw. Versions below it are affected.

The wording includes conditions the score may not show: authenticated. Read the record before you decide it does not apply to you.

How we would triage it

This is our judgement.

The commands only read: they print a version or list what is installed. They come from general knowledge of this kind of product, not from the sources, so check them against the vendor's page before you run them. Words in capitals are for you to fill in.

Step 1: Find where ThingLinks runs and which version

• Ask your IT provider, or check your servers and containers, for ThingLinks or the thinglinks-rule package.
• Record each version. Anything below 1.4.0 is affected, per the record.

docker ps --format '{{.Names}} {{.Image}}'
docker images | grep -i thinglinks

Step 2: Reduce who can reach it

• Keep the admin console and API off the internet where you can, for example behind a VPN.
• Review which accounts exist and remove ones nobody needs, since any login can be used.

Step 3: Update to 1.4.0

• Move to ThingLinks 1.4.0, which the vendor names as the fixed version.
• This also closes CVE-2026-62849. Take a backup first and note that the release is a large one.

Step 4: Confirm the fix and look for misuse

• Check the running version is 1.4.0 or later and write it down.
• Look at the activity listed under what to look for.

To close it, read the version from the product itself, not from an old inventory, and save the output with the date. If you cannot update today, write down who owns it, the new date, and what limits exposure until then.

Send this to your IT provider

Copy it, change the names and dates, and send it. It is a draft for you to check, not a template tested with any provider.

Hello. We need to check our exposure to CVE-2026-62849 and CVE-2026-62853 in ThingLinks (mqttsnet). The second lets a logged-in user run code on the server through the Groovy script test endpoint in versions below 1.4.0. Please tell us whether we run ThingLinks, where, and which version. If it is below 1.4.0, please update to 1.4.0, the version the vendor names as fixed, and tell us who can log in. Please confirm the version and the fix in writing by the date you agree with us. Thank you.

The weakness behind it

The record classes this as CWE-78 and CWE-94.

• CWE-78 →What this kind of mistake is, and which exploited vulnerabilities share it.
• CWE-94 →What this kind of mistake is, and which exploited vulnerabilities share it.

The sources, in their words

The CVE record:

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed `Groovy compilation and loading` flow. An authenticated attacker can provide code that is compiled and instantiated on the server, resulting in arbitrary server-side code execution. The issue affects the `rule engine`'s Groovy script test/register flow. This issue is fixed in version 1.4.0.

Versions of mqttsnet thinglinks the record lists as affected:

• < 1.4.0

What we do not know yet

• The sources do not say whether the flaw is being exploited. CISA did not list it when read.
• They do not say whether any configuration, other than having an account, limits who can reach the endpoint.
• They do not name any workaround short of updating to 1.4.0.
• They do not say how to tell whether a server has already been attacked.
• Exploitation is not recorded. That is not the same as none.
• This is a new record: scores, versions and wording can change in the first days, and they are as at 31 October 2026. We read the vendor pages listed under Sources; nothing here has been tested.
• The sections headed "The bottom line", "Does this apply to you?", "What it is", "Why it matters", "Exposure by situation", "Things people will get wrong", "How we would triage it" and "Send this to your IT provider" are our interpretation of the sources, not a statement by CISA or the vendor.

• The day's CVE highlight →The three new records we picked that day, and how we chose them.
• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.