Access Control Flaw in Tapo Cloud MQTT Broker by TP-Link

CVE-2026-105821

What is CVE-2026-105821?

The Tapo Cloud MQTT broker has a vulnerability that allows authenticated Tapo devices to exploit a broken access control mechanism in a proxy topic. When requesting service tokens, the broker fails to verify the device ID associated with the request. An attacker with access to a Tapo device and knowledge of another device's ID can obtain a targeted device's token. This access may enable the attacker to upload malicious content to the compromised user's Tapo Cloud storage, making it appear as legitimate events in the Tapo app. Additionally, it poses risks for unauthorized retrieval of internal service information and potential abuse of outbound service capabilities, affecting overall service availability.

References