CVE-2026-55177

Name of the Vulnerable Software and Affected Versions CloudTAK versions prior to 13.10.0

Description CloudTAK contains a Server-Side Request Forgery (SSRF) issue that allows any authenticated user to force the server to make arbitrary outbound GET or POST requests to internal addresses. This occurs because the software fails to validate destination URLs against private, loopback, or link-local ranges before fetching them. An attacker can exploit this to read cloud instance metadata, including temporary IAM credentials, enumerate internal services, and exfiltrate response bodies from hosts reachable only within the deployment VPC.

The issue affects the ESRI helper family of routes in api/routes/esri.ts and the associated library in api/lib/esri.ts. Specifically, the sniff() function only validates the URL pathname (checking for /rest, /arcgis/rest, or /sharing/rest) and ignores the host, allowing internal targets to bypass the check.

Recommendations Update CloudTAK to version 13.10.0. As a temporary mitigation, restrict access to the /api/esri* API endpoints to trusted users only.