CVE-2026-54546: CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated

Executive brief

CloudTAK is a web-based interface for managing geospatial data and basemaps. A security vulnerability in the basemap import feature allows any logged-in user to force the server to make requests to internal systems. This could allow an attacker to steal sensitive cloud credentials or access private internal databases and services that are not supposed to be reachable from the internet.

Technical details

An authenticated SSRF vulnerability exists in the `PUT /api/basemap` endpoint of CloudTAK. The `importBasemapURL` function in `api/routes/basemap.ts` uses the `fetch` API to retrieve attacker-supplied URLs without validating the destination IP address or hostname. Because the server reflects portions of the retrieved JSON response back to the user, this is a full-read SSRF. Attackers can bypass simple filters using decimal IP encoding or by leveraging the default redirect-following behavior of `fetch`. This can be used to access the AWS/cloud metadata service (169.254.169.254) to exfiltrate IAM credentials or to probe internal RFC1918/loopback services. A fix involving DNS resolution and IP-range validation (safeFetch) is recommended.

Affected products

• dfpc-coe CloudTAK <= 13.5.0

Timeline

• 2026-06-05: advisory: GitHub Advisory published.
• 2026-07-17: disclosed: Public disclosure of CVE-2026-54546.

References

• https://api.github.com/users/tonghuaroot
• https://github.com/tonghuaroot
• https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D
• https://api.github.com/users/tonghuaroot/repos
• https://avatars.githubusercontent.com/u/23011166?v=4
• https://api.github.com/users/tonghuaroot/events%7B/privacy%7D