Vulnerability · Published Nov 3, 2026 · Assigned by TPLink

CVE-2026-105822Server-Side Request Forgery in Tapo Cloud MQTT Proxy

High 8.3

In plain English

A high-severity server-side request forgery in Tapo Cloud Service from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 4.0)8.3High

Exploit odds (30 days)0.2%top 90.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker may exploit this vulnerability to cause the Tapo Cloud service to send requests to an attacker-controlled server. Successful exploitation may cause the Tapo Cloud service to send a request to an attacker-controlled server, exposing the internal information and causing potential Distributed Denial-of-Service (DDoS).

Affected products (as reported)

Vendor	Product	Versions
TP-Link Systems Inc.	Tapo Cloud Service	0 – before N/A

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:L

References

https://www.tp-link.com/us/support/faq/5370/ vendor-advisory