CVE-2026-105822— Server-Side Request Forgery in Tapo Cloud MQTT Proxy
Quick assessment
Affected
TP-Link Systems Inc. Tapo Cloud Service
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Tapo Cloud MQTT 代理存在服务器端请求伪造（SSRF）漏洞，原因是该代理在缺乏充分输入验证的情况下，接受了由用户控制的主机值。攻击者可利用此漏洞，诱导 Tapo Cloud 服务向攻击者控制的服务器发送请求。 成功利用该漏洞可能导致 Tapo Cloud 服务向攻击者控制的服务器发起请求，从而泄露内部信息，并可能引发分布式拒绝服务（DDoS）攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105822
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Server-Side Request Forgery in Tapo Cloud MQTT Proxy
Source: CVE Program / CVE List V5
Vulnerability Description
The Tapo
Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability
because it accepts a user-controlled host value without sufficient input
validation. An attacker may exploit this vulnerability to cause the Tapo Cloud
service to send requests to an attacker-controlled server.
Successful
exploitation may cause the Tapo Cloud service to send a request to an
attacker-controlled server, exposing the internal information and causing
potential Distributed Denial-of-Service (DDoS).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:L
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| TP-Link Systems Inc. | Tapo Cloud Service | 0 ~ N/A | - |
|
II. Public POCs for CVE-2026-105822
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105822
请登录查看更多情报信息。
Other References for CVE-2026-105822 (1)
-
https://www.tp-link.com/us/support/faq/5370/ vendor-advisory
Same Patch Batch · TP-Link Systems Inc. · 2026-11-03 · 3 CVEs total
| CVE-2026-105821 | 8.3 HIGH | Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy |
| CVE-2026-118865 | 7.3 HIGH | Authenticated OS Command Injection in Archer AX3000 v2 Offline Download Component |
IV. Related Vulnerabilities
Same vendor: TP-Link Systems Inc.
-
CVE-2026-118865
Authenticated OS Command Injection in Archer AX3000 v2 Offli -
CVE-2026-105821
Broken Access Control Leading to Cross-Device Token Issuance -
CVE-2026-102816
Unauthenticated Wireless Regulatory Region Configuration in -
CVE-2026-102815
Command Injection in tmpServer Allows Local Privilege Escala -
CVE-2026-102814
Improper Authentication in TP-Link TDDP v2 Allows Root Comma
Same weakness: CWE-918
-
CVE-2026-118628
MLflow get-artifacts Server-Side Request Forgery Information -
CVE-2026-121581
ArcReel Provider Test-Connection Endpoint test server-side r -
CVE-2026-120715
Devolutions Server 2026.3.12.0 及更早版本存在 SSRF 漏洞 -
CVE-2026-121580
Devolutions Server 2026.2.22.0 及更早版本 SSRF 漏洞 -
CVE-2026-114582
Server-side request forgery via SpatialReference string inpu