Unauthorized Privileged Certificate Management in Omada Controller by TP-Link
CVE-2026-107795

7.5HIGH

Key Information:

Vendor: Tp-link Systems Inc.
Status: Omada Software Controller
Vendor: CVE Published:; 14 October 2026

🔔 Create Tp-link Systems Inc. Vulnerability Alert

What is CVE-2026-107795?

The Omada Controller's MSP and OpenAPI APIs for certificate and private-key management lack proper administrative authorization checks. This flaw allows a low-privileged authenticated user to conduct sensitive operations, such as uploading or deleting the TLS certificate and private key of the controller. If exploited, this could lead to the disruption of secure management access, posing a significant risk to the integrity of secure connections. Users are advised to follow vendor recommendations and apply necessary patches to mitigate this issue.