CVE-2026-54546

Name of the Vulnerable Software and Affected Versions CloudTAK versions prior to 13.22.1

Description CloudTAK contains a server-side request forgery (SSRF) flaw in the authenticated PUT /api/basemap endpoint. The importBasemapURL() function in api/routes/basemap.ts uses fetch(url) to retrieve content from a user-supplied URL without validating the resolved IP address or re-validating redirects. While BasemapProtocol.isValidURL in api/lib/interface-basemap.ts checks for HTTP or HTTPS schemes, it is not utilized in the vulnerable import path.

An authenticated user can provide direct internal addresses, alternate IP encodings, or URLs that redirect to internal addresses to access cloud metadata, loopback, private, and CGNAT HTTP services. Because the server reflects fields from the OptionalTileJSON response—such as name, attribution, and tiles[0]—back to the caller, this is a full-read SSRF. This allows an attacker to steal cloud instance credentials, enumerate internal services, and read internal-only HTTP endpoints from the network position of the API server.

Recommendations Update CloudTAK to version 13.22.1. As a temporary mitigation, restrict access to the PUT /api/basemap endpoint to trusted users only.