Server-Side Request Forgery in CloudTAK (CVE-2026-55177)

CVE-2026-55177 is an authenticated full-read Server-Side Request Forgery (CWE-918) in CloudTAK's `/api/esri*` route family, where user-controlled URLs supplied via request body or query parameters are fetched by the server without any IP, DNS, or hostname classification against private, loopback, or link-local ranges. Any authenticated user (no administrative role required) can direct the CloudTAK server to issue outbound requests to internal addresses such as the cloud instance-metadata service or loopback admin ports, with the full upstream response body returned to the caller, enabling cloud credential theft, internal network enumeration, and data exfiltration. Public POC available. Affected versions: - <= 13.7.0 We recommend updating to: >= v13.10.0. CVSS ? · our assessment: this_week Vendor advisory: https://github.com/dfpc-coe/CloudTAK/security/advisories/GHSA-r95q-fp26-h3hc Details: https://vuln.today/cve/CVE-2026-55177