tapo_cloud_service vulnerabilities
CVEs whose affected-version data names the tapo_cloud_service package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-105822High· 8.3Server-Side Request Forgery in Tapo Cloud MQTT Proxy
The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker may exploit this vulnerability to cause the Tapo Cloud…
▾ TwilightTP-Link Systems Inc. · Tapo Cloud ServiceEPSS 0.20%via CVEORG
CVE-2026-105821High· 8.3Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy
The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo devices to request service tokens. The broker does not verify that the device ID supplied in a proxy request belongs to…
▾ TwilightTP-Link Systems Inc. · Tapo Cloud ServiceEPSS 0.24%via CVEORG