Live › vulnerability › CVE-2026-105821
The Tapo Cloud MQTT broker does not check that a device ID in a proxy request belongs to the logged-in device. An attacker with their own Tapo device and another device's ID can get a token for that device and upload content that appears in the victim's Tapo app as a real event.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 20:49 UTC. All times on this page are UTC.
Tapo Cloud users could have fake events appear in their Tapo app. The flaw is in TP-Link's cloud MQTT broker, not in the device. An attacker needs their own Tapo device and the victim device's ID. TP-Link has not named affected models or firmware. People with no Tapo devices can skip it.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo devices to request service tokens. The broker does not verify that the device ID supplied in a proxy request belongs to the authenticated device. An attacker who owns a Tapo device and knows another device's ID may obtain a device token scoped to the target device and use it to upload attacker-controlled content to the target user's Tapo Cloud storage. The content may then be presented in the Tapo app as a legitimate event.
Successful exploitation may allow an attacker to upload attacker-controlled content that is presented to a target user as a legitimate Tapo event, retrieve internal service information through crafted proxy requests, or abuse Tapo Cloud outbound request capability in activity that could affect service availability.
This page as .md · .json · in your agent: get_signal("CVE-2026-105821")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.