Security Advisory: Multiple Vulnerabilities in Tapo Cloud Services (CVE-2026-105821 & CVE-2026-105822)

Description of Vulnerabilities and Impact

CVE-2026-105821: Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy

The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo devices to request service tokens. The broker does not verify that the device ID supplied in a proxy request belongs to the authenticated device. An attacker who owns a Tapo device and knows another device's ID may obtain a device token scoped to the target device and use it to upload attacker-controlled content to the target user's Tapo Cloud storage. The content may then be presented in the Tapo app as a legitimate event.

Successful exploitation may allow an attacker to upload arbitrary content to another user’s Tapo Cloud storage, resulting in unauthorized modification of cloud-stored content.

CVSS v4.0 Score: 8.3 / High

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2026-105822: Server-Side Request Forgery in Tapo Cloud MQTT Proxy

The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker may exploit this vulnerability to cause the Tapo Cloud service to send requests to an attacker-controlled server.

Successful exploitation may cause the Tapo Cloud service to send a request to an attacker-controlled server, exposing the internal information and causing potential Distributed Denial-of-Service (DDoS).

CVSS v4.0 Score: 8.3 / High

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:L

Affected Products/Versions and Fixes:

Disclaimer:

This advisory is provided for informational purposes only and is subject to change without notice. The information is provided “as is” without warranties of any kind. TP-Link recommends that customers promptly apply available firmware updates or implement documented workarounds as provided in this advisory. Devices/systems that are not updated or mitigated as described may remain vulnerable, and TP-Link disclaims any responsibility or liability for any damages or losses arising from a failure to implement such updates.