CVE-2026-54546

MediumCVSS 5.0

Published: 17/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

29th percentile - higher than 29% of all known CVEs

Summary

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap endpoint passes an attacker-controlled URL through importBasemapURL() to fetch(url) without resolved-address classification or redirect revalidation. BasemapProtocol.isValidURL checks only the HTTP or HTTPS scheme and is not applied on the vulnerable import path. Direct internal addresses, alternate IP encodings, and redirects to internal addresses can reach cloud metadata, loopback, private, and CGNAT HTTP services. The OptionalTileJSON response reflects fields including name, attribution, and tiles[0] to the caller, making the request forgery full-read rather than blind and enabling cloud credential theft and internal service disclosure.

Risk Assessment

This can lead to cloud credential theft and internal service disclosure, posing a serious security threat.

Recommendation

Update CloudTAK to version 13.22.1, which contains the fix for this issue.

Other vulnerabilities in CloudTAK

CVE-2026-55177High
CloudTAK versions prior to 13.10.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the ESRI route family (api/routes/esri.ts). These routes accept an attacker-controlled URL and fetch it without any validation against private, loopback, or link-local ranges. Any authenticated user can force the CloudTAK server to make requests to internal resources, and the responses are returned to the attacker.

Original NVD description (English source)

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap endpoint passes an attacker-controlled URL through importBasemapURL() in api/routes/basemap.ts to fetch(url) without resolved-address classification or redirect revalidation. BasemapProtocol.isValidURL in api/lib/interface-basemap.ts checks only the HTTP or HTTPS scheme and is not applied on the vulnerable import path. Direct internal addresses, alternate IP encodings, and redirects to internal addresses can reach cloud metadata, loopback, private, and CGNAT HTTP services. The OptionalTileJSON response reflects fields including name, attribution, and tiles[0] to the caller, making the request forgery full-read rather than blind and enabling cloud credential theft and internal service disclosure. This issue is fixed in version 13.22.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS