Internal Service Disclosure in CloudTAK by DFPC COE
CVE-2026-54546
5MEDIUM
What is CVE-2026-54546?
CloudTAK, a situational awareness tool, contains a vulnerability in the authenticated PUT /api/basemap endpoint prior to version 13.22.1. This flaw arises when the endpoint processes attacker-controlled URLs without proper validation, allowing the fetching of sensitive data from cloud metadata and internal services. This can lead to significant security risks such as cloud credential theft and unauthorized access to internal service information, as the system fails to appropriately classify redirected addresses, exposing internal resources to potential attackers. The issue has been resolved in version 13.22.1, making it crucial for users to upgrade promptly.
Affected Version(s)
CloudTAK < 13.22.1