{"id":"CVE-2026-105822","kind":"vulnerability","aliases":["CVE-2026-105822"],"related":[],"title":"Tapo Cloud MQTT proxy: unvalidated host value enables server-side request forgery","description":"The Tapo\nCloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability\nbecause it accepts a user-controlled host value without sufficient input\nvalidation. An attacker may exploit this vulnerability to cause the Tapo Cloud\nservice to send requests to an attacker-controlled server.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may cause the Tapo Cloud service to send a request to an\nattacker-controlled server, exposing the internal information and causing\npotential Distributed Denial-of-Service (DDoS).","summary":"The Tapo Cloud MQTT proxy accepts a user-controlled host value without sufficient validation. An attacker can make the Tapo Cloud service send requests to a server they control, exposing internal information and enabling possible denial-of-service.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud","mqtt","ssrf","tapo","tp-link","vendor"],"not_affected_if":[],"how_to_check":"Nothing to check on your side: this is a flaw in TP-Link's hosted Tapo Cloud service, not software or firmware you install. Whether specific devices or accounts are involved is unknown; no TP-Link advisory was found.","fix":"unknown: no TP-Link advisory or fixed version found. Any fix would be applied by TP-Link on its cloud service; TP-Link's advisory page (tp-link.com/us/product-security/security-advisory/) listed no entries when checked.","status":"open","published_at":"2026-11-03T20:18:06+00:00","first_seen_at":"2026-11-03T20:49:22+00:00","triaged_at":"2026-11-03T20:49:51+00:00","updated_at":"2026-11-03T21:03:27+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-03T20:49:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Tapo Cloud MQTT proxy: unvalidated host value enables server-side request forgery","impact":"medium","summary":"The Tapo Cloud MQTT proxy accepts a user-controlled host value without sufficient validation. An attacker can make the Tapo Cloud service send requests to a server they control, exposing internal information and enabling possible denial-of-service.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["tapo","tp-link","cloud"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Cloud service sends requests to attacker server, exposing internal information","analyst_note":"Confirm with TP-Link's own advisory whether a fix or mitigation exists and which Tapo devices or accounts are involved.","how_to_check":"unknown","plain_action":"Tapo smart home users should wait for TP-Link to release a fix for the Tapo cloud service; the sources do not state an action to take.","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The flaw is in TP-Link's hosted Tapo Cloud service, not in software customers install. The sources do not say which devices or accounts are involved, so the unknown details are not guessed here.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000665,"input_tokens":4205,"output_tokens":488,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm with TP-Link's own advisory whether a fix or mitigation exists and which Tapo devices or accounts are involved.","search":"'-105822':16A,19A '-2026':15A,18A 'accept':33B,84C 'attack':44B,96C,113C,131C 'attacker-control':112C,130C 'caus':102C,119C,139C 'cloud':2A,20B,30B,49B,70C,105C,122C 'contain':73C 'control':37B,57B,88C,114C,132C 'cve':14A,17A 'ddos':146C 'denial':65B,143C 'denial-of-servic':64B,142C 'distribut':141C 'enabl':8A,62B 'exploit':98C,117C 'expos':58B,134C 'forgeri':13A,79C 'host':6A,38B,89C 'inform':60B,137C 'input':93C 'intern':59B,136C 'link':26B 'make':46B 'may':97C,118C 'mqtt':3A,21B,31B,71C 'possibl':63B 'potenti':140C 'proxi':4A,32B,72C 'request':12A,52B,78C,109C,127C 'send':51B,108C,125C 'server':10A,55B,76C,115C,133C 'server-sid':9A,75C 'servic':50B,67B,106C,123C,145C 'side':11A,77C 'ssrf':22B,80C 'success':116C 'suffici':41B,92C 'tapo':1A,23B,29B,48B,69C,104C,121C 'tp':25B 'tp-link':24B 'unvalid':5A 'user':36B,87C 'user-control':35B,86C 'valid':42B,94C 'valu':7A,39B,90C 'vendor':27B 'vulner':81C,100C 'without':40B,91C","nicknames":[],"mitigations":[],"who_affected":"The flaw is in TP-Link's hosted Tapo Cloud service, not in software customers install. The sources do not say which devices or accounts are involved, so the unknown details are not guessed here.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Tapo smart home users should wait for TP-Link to release a fix for the Tapo cloud service; the sources do not state an action to take.","pkeys":[],"ptokens":[],"labels":["cloud","high","mqtt","ssrf","tapo","tplink","vendor"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f23511db-6c3e-4e32-a477-6aa17d310630","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105822","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105822","severity":null,"published_at":"2026-11-03T20:18:06+00:00","modified_at":"2026-11-03T20:18:06+00:00","first_seen_at":"2026-11-03T20:49:22+00:00","fetched_at":"2026-11-03T20:49:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105822:1562","url":null,"severity":null,"published_at":"2026-11-03T21:03:27+00:00","modified_at":"2026-11-03T21:03:27+00:00","first_seen_at":"2026-11-03T21:03:27+00:00","fetched_at":"2026-11-03T21:03:27+00:00","note":"No TP-Link primary advisory found (advisory index empty, JS-rendered). Only NVD/CNA text, Rapid7, OpenCVE (Tapo Cloud Service, no versions/remediation). No exploitation or PoC seen. Sibling CVE-2026-105821 (same MQTT proxy) is being researched in parallel. Nothing verified."}],"documents":[{"id":60683,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105822","title":"NVD: CVE-2026-105822","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":60684,"url":"https://app.opencve.io/cve/CVE-2026-105822","title":"OpenCVE: CVE-2026-105822 (TP-Link Tapo Cloud Service)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}