# CVE-2026-105822: TP-Link Tapo Cloud MQTT Proxy server-side request forgery

Source: https://junglewise.ai/threats/cve-2026-105822-the-tapo-cloud-mqtt-proxy-contains-a-server-side-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-105822 · Severity: info · Published 2026-11-03

TP-Link's Tapo Cloud service, which stores and manages smart home device data and events, contains a server-side request forgery vulnerability in its MQTT proxy component. An attacker can craft requests with malicious host values to force the Tapo Cloud service to make requests to attacker-controlled servers, potentially exposing internal system information or facilitating denial-of-service attacks.

Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-105822 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105822 being exploited in the wild.

**How severe is CVE-2026-105822?** Informational severity, published 3 November 2026.

**Which products and versions are affected?** TP-Link Tapo Cloud.

**Is there a fix for CVE-2026-105822?** Yes: fixed in Tapo Cloud backend infrastructure (cloud-side remediation; no user updates required). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105822 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-105822?** Check whether you run TP-Link Tapo Cloud. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Tapo Cloud backend infrastructure (cloud-side remediation; no user updates required)

## Technical details

The Tapo Cloud MQTT proxy fails to properly validate user-controlled host parameters before processing network requests, enabling server-side request forgery attacks. An unauthenticated network attacker can exploit this to redirect the proxy's outbound requests to arbitrary hosts, accessing internal resources or leveraging the cloud infrastructure for attacks. TP-Link remediated this on the cloud backend; no user action is required.

## Affected products

- TP-Link Tapo Cloud

## Timeline

- 2026-11-03: disclosed

## References

- [https://www.tp-link.com/us/support/faq/5370/](https://www.tp-link.com/us/support/faq/5370/)

## Related threats

- [TP-Link Tapo Cloud MQTT broken access control in proxy](https://junglewise.ai/threats/cve-2026-105821-the-tapo-cloud-mqtt-broker-contains-a-broken-access-control)