Broken access control in TP-Link Tapo Cloud MQTT proxy
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
TP-Link Tapo Cloud Service has a broken access control flaw (CWE-862) in the Tapo Cloud MQTT broker's proxy topic that devices use to request service tokens. The broker does not check that the device ID in a proxy request belongs to the authenticated device. An attacker with their own Tapo device and another device's ID can get a token for that device and upload content to the target user's Tapo Cloud storage, where it may appear in the Tapo app as a legitimate event.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo devices to request service tokens. The broker does not verify that the device ID supplied in a proxy request belongs to the authenticated device. An attacker who owns a Tapo device and knows another device's ID may obtain a device token scoped to the target device and use it to upload attacker-controlled content to the target user's Tapo Cloud storage. The content may then be presented in the Tapo app as a legitimate event. Successful exploitation may allow an attacker to upload attacker-controlled content that is presented to a target user as a legitimate Tapo event, retrieve internal service information through crafted proxy requests, or abuse Tapo Cloud outbound request capability in activity that could affect service availability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Tapo Cloud Service.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
- Fix · CNA Tapo Cloud Service (TP-Link Systems Inc.) Fixed in N/A
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
TP-Link Systems Tapo Cloud Service — tp-link.com/us/support/faq/5370
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-84555 Server-side request forgery in TP-Link Tapo Cloud MQTT proxyPriority LOW 35
Timeline
- 2026-11-03 Threatist record created from CVE-2026-105821
- 2026-11-03 Alias added: GHSA-w8wf-fr39-3c38
- 2026-11-05 Priority changed: MEDIUM → LOW
- 2026-11-06 CISA SSVC decision points changed
References
More TP-Link vulnerabilities
- TI-2023-16571 TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain… KEVCVSS 3.1HIGH 8.8
- TI-2023-01313 Command injection in TP-Link Archer AX21 KEVCVSS 3.1HIGH 8.8
- TI-2020-14907 TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the… KEVCVSS 3.1HIGH 8.8
- TI-2025-08589 Authenticated RCE via Parental Control command injection KEVCVSS 4.0HIGH 8.6
- TI-2015-02672 Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317… KEVCVSS 3.1HIGH 7.5
- TI-2023-27456 Authentication bypass by spoofing in TP-Link TL-WR841N KEVCVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-105821 · CVE Program
- CVE-2026-105821 · NVD
- FIRST EPSS
- GHSA-w8wf-fr39-3c38 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences