CVE-2026-105822

The record

The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker may exploit this vulnerability to cause the Tapo Cloud service to send requests to an attacker-controlled server. Successful exploitation may cause the Tapo Cloud service to send a request to an attacker-controlled server, exposing the internal information and causing potential Distributed Denial-of-Service (DDoS).

Affected packages

Related vulnerabilities

• CVE-2026-121581 A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. CWE-918
• CVE-2026-121580 Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server… CWE-918
• CVE-2026-120715 Server-side request forgery in the Active Directory credential validation in Devolutions… CWE-918
• CVE-2026-121561 Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request… CWE-918
• CVE-2026-114582 An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before… CWE-918
• CVE-2026-111362 An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before… CWE-918
• CVE-2026-121431 AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows… CWE-918
• CVE-2026-121421 SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in… CWE-918