CVE-2026-105822
Server-Side Request Forgery in Tapo Cloud MQTT Proxy
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker may exploit this vulnerability to cause the Tapo Cloud service to send requests to an attacker-controlled server. Successful exploitation may cause the Tapo Cloud service to send a request to an attacker-controlled server, exposing the internal information and causing potential Distributed Denial-of-Service (DDoS).
| CWE | CWE-918 |
| Vendor | tp-link systems inc. |
| Product | tapo cloud service |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for tp-link systems inc. tapo cloud service
Be the first to know when new unknown vulnerabilities affecting tp-link systems inc. tapo cloud service are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
TP-Link Systems Inc. / Tapo Cloud Service
0 < N/A
Credits
davidsclee (davidleesecurity.co.uk)