CVE-2026-55177: CloudTAK authenticated full-read SSRF in ESRI routes

Executive brief

CloudTAK, a situational awareness platform, contains a vulnerability that allows any logged-in user to force the server to make requests to internal network locations. This could allow an attacker to steal sensitive cloud credentials, access internal databases, or probe private infrastructure that is not normally accessible from the internet. An exploit could lead to a full compromise of the cloud environment where the software is hosted.

Technical details

An authenticated SSRF exists in the `/api/esri*` routes of CloudTAK. The application fails to apply IP, DNS, or hostname classification (such as the `isSafeUrl` guard used elsewhere in the project) to user-supplied URLs before fetching them via the `@tak-ps/etl` library. This is a 'full-read' SSRF because the application returns the upstream response body or detailed error messages to the user. An attacker with any valid authentication token can target internal addresses, including the cloud instance metadata service (169.254.169.254) to retrieve IAM credentials, or loopback services (127.0.0.1). The vulnerability was patched in version 13.10.0 by centralizing the `isSafeUrl` guard within the ESRI library.

Affected products

• dfpc-coe CloudTAK < 13.10.0

Timeline

• 2026-06-10: disclosed
• 2026-07-17: advisory: GitHub Advisory published

References

• https://api.github.com/users/tonghuaroot
• https://github.com/tonghuaroot
• https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D
• https://api.github.com/users/tonghuaroot/repos
• https://avatars.githubusercontent.com/u/23011166?v=4
• https://api.github.com/users/tonghuaroot/events%7B/privacy%7D