---
id: "CVE-2026-62849"
kind: "vulnerability"
aliases: ["CVE-2026-62849"]
title: "ThingLinks IoT platform: unauthenticated SQL injection lets attackers tamper with sensor data"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["iot", "tdengine", "thinglinks", "time-series", "vendor"]
not_affected_if: ["not-thinglinks", "version-1.4.0-or-later"]
published_at: "2026-10-30T21:17:14+00:00"
first_seen_at: "2026-10-30T21:25:53+00:00"
updated_at: "2026-10-30T21:26:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62849", "first_seen_at": "2026-10-30T21:25:53+00:00"}]
---

# ThingLinks IoT platform: unauthenticated SQL injection lets attackers tamper with sensor data

ThingLinks, an enterprise IoT platform, has an SQL injection in its TDengine insert endpoint, reachable without logging in. An attacker can insert unintended rows or overwrite existing time-series sensor readings.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ThingLinks version; the sources say versions before `1.4.0` are affected.
- Look for the `/anyUser/tds/insertTableData` endpoint in your deployment and whether it is reachable from outside your network.

## Fix

- Upgrade ThingLinks to `1.4.0` or later.

## Timeline

- 2026-10-30T21:25:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62849

## From the sources

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows request-controlled JSON field values submitted to `/anyUser/tds/insertTableData` to reach unsafe SQL construction in the `TDS mapper`. A remote unauthenticated attacker can tamper with TDengine time-series data, including inserting unintended rows or overwriting existing readings. The affected surface is the TDS module's insert-table-data flow and TDengine mapper SQL generation. This issue is fixed in version 1.4.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_