CVE-2026-105822: Server-Side Request Forgery in Tapo Cloud MQTT Proxy
The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker may exploit this vulnerability to cause the Tapo Cloud service to send requests to an attacker-controlled server.
Successful exploitation may cause the Tapo Cloud service to send a request to an attacker-controlled server, exposing the internal information and causing potential Distributed Denial-of-Service (DDoS).
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to supply a user-controlled host value to the Tapo Cloud MQTT proxy. No privileges or user interaction are indicated in the provided severity vector, but exploitation has high attack complexity.
Who is exposed to the impact?
The affected component is the Tapo Cloud MQTT proxy and associated Tapo Cloud service. Successful exploitation can make the cloud service issue requests to an attacker-controlled server, potentially exposing internal information and contributing to DDoS.
How can I tell whether an exploitation attempt may be occurring?
The available information does not provide specific indicators of compromise or logging guidance. Relevant evidence would be requests initiated by the Tapo Cloud service toward unexpected or attacker-controlled hosts, where such activity is available for review.