CVE-2026-55177 CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard
Authenticated attackers can exploit unvalidated URL parameters in ESRI routes to perform Server-Side Request Forgery, reading internal cloud metadata and credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55177?
CVE-2026-55177 is a high-severity server-side request forgery vulnerability in dfpc-coe CloudTAK, published on 30 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family (api/routes/esri.ts) takes a fully attacker-controlled URL from the request (POST /api/esri body url, and the portal / server / layer query parameters on the GET /api/esri/* routes) and passes it into EsriBase / EsriProxyPortal / EsriProxyServer / EsriProxyLayer in api/lib/esri.ts, which fetch it with the bare fetch from @tak-ps/etl. No IP / DNS / hostname classification is applied at any point, so the destination is never validated against private, loopback, or link-local ranges. Any authenticated user (the routes only require Auth.is_auth(config, req, { anyResources: true }), i.e. any token, not an admin) can therefore make the CloudTAK server issue arbitrary outbound GET/POST requests to internal addresses such as the cloud instance-metadata service (169.254.169.254), loopback admin ports (127.0.0.1:<port>), and other hosts reachable only from inside the deployment VPC. This is a full-read SSRF, not blind: on success the upstream JSON body is returned to the caller via res.json(...), and on failure the upstream error string is reflected verbatim as ESRI Server Error: <message>. An attacker can read cloud metadata (and the temporary IAM credentials the instance role exposes), enumerate internal services, and exfiltrate their response bodies. The sniff() URL classifier provides no protection: it only pattern-matches the pathname (/rest, /arcgis/rest, /sharing/rest), so a URL like http://169.254.169.254/arcgis/rest or http://127.0.0.1:8500/rest passes sniff() and is fetched. This issue has been patched in version 13.10.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-55177?
2 open source packages ship an affected version, including @tak-ps/cloudtak.
| Package | Affected | Fixed in |
|---|---|---|
@tak-ps/cloudtak npm | All versions | 13.10.0 |
@tak-ps/cloudtak npm | All versions | 13.10.0 |
How do I fix CVE-2026-55177?
Upgrade @tak-ps/cloudtak to 13.10.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-55177 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55177 exists.
Sources
Also known as GHSA-r95q-fp26-h3hc.