{"id":"CVE-2026-105822","title":"Server-Side Request Forgery in Tapo Cloud MQTT Proxy","summary":"The Tapo\nCloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability\nbecause it accepts a user-controlled host value without sufficient input\nvalidation. An attacker may exploit this vulnerability to cause the Tapo Cloud…","severity":"high","cvss":8.3,"cvssVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:L","cvssSource":"cna","cwe":["CWE-918"],"vendor":"TP-Link Systems Inc.","product":"Tapo Cloud Service","affected":["tapo_cloud_service < N/A"],"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T19:41:21.357Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-105822","references":[{"url":"https://www.tp-link.com/us/support/faq/5370/"}],"tags":["cve.org"],"epss":0.00197,"epssPercentile":0.09482,"ingestedAt":"2026-11-05T20:33:06.401Z","slug":"CVE-2026-105822","body":"## Overview\n\nThe Tapo\nCloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability\nbecause it accepts a user-controlled host value without sufficient input\nvalidation. An attacker may exploit this vulnerability to cause the Tapo Cloud\nservice to send requests to an attacker-controlled server.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may cause the Tapo Cloud service to send a request to an\nattacker-controlled server, exposing the internal information and causing\npotential Distributed Denial-of-Service (DDoS).\n\n## Affected\n\n- `tapo_cloud_service < N/A`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":45.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}