EUVD-2026-116271Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Tapo Cloud MQTT proxy endpoint
-
DeliverySubmit request with attacker-controlled host value
-
ExploitSSRF: cloud service fetches attacker URL
-
ExecutionExfiltrate internal information / pivot requests
-
ImpactDDoS third party or expose internal data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to the Tapo Cloud MQTT proxy and the ability to supply the user-controlled host value that the proxy accepts without sufficient input validation; per the CVSS vector no authentication is required (PR:N) and no user interaction (UI:N). The limiting factors are the vendor-assigned high attack complexity (AC:H) - whose cause is not described in the available sources - and the fact that this is a vendor-operated cloud service, so exploitation depends on the backend state TP-Link runs rather than any customer configuration; a server-side vendor fix can neutralize it centrally. |
| Impact | This is a server-side request forgery flaw in the Tapo Cloud MQTT proxy, reported by the vendor (TP-Link) itself and tracked by vuln.today as a 'this_week' priority rather than an emergency. The input CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) describes a network-reachable, unauthenticated issue (PR:N) but assigns high attack complexity (AC:H); the available description does not explain what makes the attack complex, so that AC:H is not corroborated by the mechanism described and should be treated as vendor-assigned. No EPSS score, no CISA KEV listing, and no public exploit or PoC reference are present in the input, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. Because this is a server-side flaw in a vendor-operated cloud service (not customer-deployed software), real-world risk is concentrated on TP-Link's own infrastructure and the internal information reachable from it; the practical exposure is partly mitigated by the fact that a cloud-side fix can be applied centrally by the vendor. Net: a legitimately serious SSRF (confidentiality of internal data plus DDoS pivot potential) but, absent KEV/EPSS/PoC signals, a 'patch on vendor timeline / this week' item rather than a confirmed-exploited emergency. |
| Exploit ScenarioDerived | An attacker submits a crafted MQTT proxy request to the Tapo Cloud service supplying an attacker-controlled host value that the service fails to validate. The service then issues a request to the attacker's server, which can leak internal/service-side information back to the attacker or be abused to direct high-volume requests at a third-party target (DDoS pivot). No public exploit or PoC is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Server-side request forgery in the Tapo Cloud MQTT proxy allows remote attackers to make TP-Link's cloud backend issue requests to a host they control, because the proxy accepts a user-controlled host value without sufficient input validation. The exposure sits in the vendor-operated Tapo Cloud service rather than in customer firmware, and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) indicates no privileges or user interaction are needed while confidentiality impact and scope change carry the most weight; TP-Link itself reported the flaw. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and vuln.today tracks it as a 'this_week' priority rather than an emergency, with the vendor's high attack-complexity rating whose cause is not described in the available sources acting as the main limiting factor.
RemediationAI
No vendor-released patch version is identified in the available data for CVE-2026-105822; the only vendor reference supplied is the TP-Link support FAQ at https://www.tp-link.com/us/support/faq/5370/, which should be treated as the authoritative source for the fix status and any published version or date. Because the vulnerable component is the TP-Link-operated Tapo Cloud MQTT proxy, the corrective change is delivered server-side by the vendor and cannot be applied by end users or device owners; there is no customer-side firmware update or configuration change identified in the supplied evidence that removes the flaw. Operators of integrations that route traffic through the Tapo Cloud MQTT proxy should track FAQ 5370 and confirm with TP-Link that the service-side validation of the accepted host value has been deployed before treating exposure as closed, and should watch for anomalous outbound request patterns or traffic spikes attributable to the proxy as an indicator that the SSRF path is still reachable. No specific workaround, feature-disable step, or network-blocking guidance is provided in the available sources, so none should be assumed effective.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the MQTT proxy inside TP-Link's Tapo Cloud, the broker-facing layer that relays device and client traffic through TP-Link infrastructure. Per the advisory, the proxy takes a host value from the request and uses it without adequate validation, which is the classic CWE-918 server-side request forgery pattern: the attacker does not attack their own client but coerces the cloud service into originating an outbound request to an attacker-chosen destination. That yields two distinct effects named in the report - disclosure of internal information reachable from the proxy's network position, and potential distributed denial-of-service through the resulting request traffic. The supplied data does not describe the exact request path, parameter name, or parsing logic involved, and it does not explain why the vendor assigned high attack complexity (AC:H) in the CVSS 4.0 vector; that complexity rating should not be interpreted as a race condition, timing window, or heap-grooming requirement, since no source states such a mechanism. The independent assessment rates the issue CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, adding a scope change with high confidentiality impact and low availability impact, and notably treats attack complexity as low where the vendor's 4.0 vector says high. Because the vulnerable code runs in a service TP-Link operates, the exploitable state is determined by TP-Link's backend deployment rather than by any customer configuration or firmware version.
Know when Tapo Cloud Service gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:L
Network-reachable unauthenticated SSRF (AV:N/PR:N); AC:L as the description implies a simple unvalidated host value, not a complex trigger; S:C and C:H for internal-info exposure, A:L for DDoS pivot.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
DescriptionCVE.org
The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker may exploit this vulnerability to cause the Tapo Cloud service to send requests to an attacker-controlled server.
Successful exploitation may cause the Tapo Cloud service to send a request to an attacker-controlled server, exposing the internal information and causing potential Distributed Denial-of-Service (DDoS).
Executive ViewAI
TP-Link's Tapo Cloud service contains a server-side request forgery vulnerability (CVE-2026-105822) that could allow unauthenticated attackers to manipulate the cloud backend into making requests to attacker-controlled hosts, potentially exposing sensitive data. Although no public exploit code or active exploitation has been identified, the flaw affects a vendor-operated cloud service and carries a high confidentiality impact, warranting immediate attention from security leadership. The scope change and network accessibility mean that customer trust and regulatory obligations could be at risk if left unaddressed.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting outbound network traffic from Tapo Cloud-dependent systems, monitoring for unusual request patterns, and isolating affected services from sensitive internal networks.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
GitHub PoC
Exploit-DB