Server-Side Request Forgery in Tapo Cloud MQTT Proxy
Affects the Tapo Cloud MQTT proxy in TP-Link's Tapo Cloud backend across all listed versions from 0. CVSS scores it 8.3 (high), and no vendor rating or fix is listed.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Not reported
Do first: Workaround: The sources do not list a workaround or mitigation for this flaw. No fix is listed, so the vendor's guidance on limiting exposure is not available in the checked facts.
- Exploitation?/40Exploitation: unknown (data gap). No CISA SSVC exploitation rating yet
- Exposure17/25No login or user action needed, reachable over the network without a login · Data gap: Advisories don't say whether default setups are affected
- Reach?/20Reach: unknown (data gap). No tracked technology or package matched
- Severity8.3/10CVSS 8.3
- No patch5/5No patch listed yet
What would change the score
- Would score about 75 if added to CISA KEV
- Would score about 70 if CISA's SSVC rates exploitation active
- Would score about 35 if advisories confirm default setups are exposed
CVE-2026-105822 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.3 (high) and affects Tapo Cloud Service; no fixed version is listed yet.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 30/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Tapo Cloud MQTT proxy is affected by a server-side request forgery flaw, where it accepts a user-supplied host value without proper validation. An attacker could abuse this to make the Tapo Cloud service send requests to a server they control, potentially exposing internal information or contributing to a denial-of-service attack.
Read the original description
The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker may exploit this vulnerability to cause the Tapo Cloud service to send requests to an attacker-controlled server. Successful exploitation may cause the Tapo Cloud service to send a request to an attacker-controlled server, exposing the internal information and causing potential Distributed Denial-of-Service (DDoS).
What to do
Workaround: The sources do not list a workaround or mitigation for this flaw. No fix is listed, so the vendor's guidance on limiting exposure is not available in the checked facts.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- TP-Link Systems Inc. Tapo Cloud Service
All versions
Evidence 1
- Advisory
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-105822
Is CVE-2026-105822 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The MQTT proxy in the Tapo Cloud backend can be made to send requests to a server chosen by an attacker. This can expose internal information and could cause Distributed Denial-of-Service (DDoS).Source: tp-link.com
Which versions are affected by CVE-2026-105822?
Tapo Cloud Service: all versions.Source: cve.now feed data
Am I affected, and how do I check?
The listed product is Tapo Cloud Service from TP-Link Systems Inc., with the range starting at version 0. The flaw is in the Tapo Cloud MQTT proxy within the backend infrastructure, so the sources give no version command or setting to check on a user's side.Source: tp-link.com
How do I fix CVE-2026-105822?
The sources list no fixed version, so no upgrade target can be named. Watch for a TP-Link update that addresses the Tapo Cloud MQTT proxy.Source: tp-link.com
What if there's no patch?
The sources do not list a workaround or mitigation for this flaw. No fix is listed, so the vendor's guidance on limiting exposure is not available in the checked facts.Source: tp-link.com