Thingsboard

What's Changed

Security

• Fixed XSS vulnerability in notification center by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15204
• Fixed CVE-2026-24308, CVE-2026-24281 and CVE-2026-24400 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15244
• Added configurable security headers and env-var-backed CORS configuration by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15254
• Fixed SSRF DNS rebinding bypass, added allow-list by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15253
• Fixed CVE-2026-24281, CVE-2026-24308, CVE-2026-24400, CVE-2026-29063, CVE-2026-29087, CVE-2026-29786, CVE-2026-30827, CVE-2026-31802, CVE-2026-32141, CVE-2026-32635, CVE-2026-27904 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15251
• Fixed CVE-2026-22731, CVE-2026-22732, CVE-2026-22733, CVE-2026-22737 + Spring Boot 3.5 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15278
• Fixed CVE-2026-33228 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15293
• Fixed CVE-2026-33870, CVE-2026-33871 and GHSA-72hv-8253-57qq by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15315
• Fixed CVE-2026-33895, CVE-2026-33894, CVE-2026-33896, CVE-2026-33750, CVE-2026-4923, CVE-2026-33671 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15322
• Fixed CVE-2026-0861, CVE-2026-0915, CVE-2025-15281 for Docker images by @ViacheslavKlimov

Core & Rule Engine

• Sanitize database error messages by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15262
• Added OTA package data cleanup by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/14775
• Fixed notification requests and RPC cleanup timeout on large datasets by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/14762
• Added WS update on telemetry deletion by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/14781

UI

• Updated locales da_DK, de_DE, el_GR, es_ES, fr_FR, it_IT, ja_JP, nl_NL, no_NO, pt_BR, tr_TR, uk_UA, zh_CN by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15237
• Hidden "Show on widgets" button on sysadmin level by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15203
• Fixed WS reconnect loop and notification spam when session limit is reached by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15219
• Fixed missing translation for Polylines toggle in map settings by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15252
• Fixed resetting of validation on storeLink property by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15168
• Fixed time series table widgets tab style by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15267
• Fixed proxy error handling for 502/503/504 HTTP status codes by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15292
• Fixed string-items-list autocomplete selection and blur handling by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15273

Edge

• Support combined PEM cert+key for Edge gRPC SSL by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15205

Transport

• MQTTS metrics and client address logging on exceptionCaught by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15112
• Fixed LwM2M Redis stores startup: use separate connections for SCAN and GET by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15143

Full Changelog: https://github.com/thingsboard/thingsboard/compare/v4.3.1...v4.3.1.1