Tapo Cloud Service vulnerabilities

2 known vulnerabilities in Tapo Cloud Service from TP-Link. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.3 High severity

  Tapo Cloud Service: Server-Side Request Forgery

  CVE-2026-105822Nov 3, 2026TP-Link

  The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker may exploit this vulnerability to cause the Tapo Cloud service to send reques

• 8.3 High severity

  Tapo Cloud Service: Missing Authorization

  CVE-2026-105821Nov 3, 2026TP-Link

  The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo devices to request service tokens. The broker does not verify that the device ID supplied in a proxy request belongs to the authenticated devi