CVE-2026-55177

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55177
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55177.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55177
Aliases
Published
2026-09-30T16:25:02Z
Modified
2026-10-01T11:30:32Z
Severity
  • 7.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guard
Details

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family (api/routes/esri.ts) takes a fully attacker-controlled URL from the request (POST /api/esri body url, and the portal / server / layer query parameters on the GET /api/esri/* routes) and passes it into EsriBase / EsriProxyPortal / EsriProxyServer / EsriProxyLayer in api/lib/esri.ts, which fetch it with the bare fetch from @tak-ps/etl. No IP / DNS / hostname classification is applied at any point, so the destination is never validated against private, loopback, or link-local ranges. Any authenticated user (the routes only require Auth.is_auth(config, req, { anyResources: true }), i.e. any token, not an admin) can therefore make the CloudTAK server issue arbitrary outbound GET/POST requests to internal addresses such as the cloud instance-metadata service (169.254.169.254), loopback admin ports (127.0.0.1:), and other hosts reachable only from inside the deployment VPC. This is a full-read SSRF, not blind: on success the upstream JSON body is returned to the caller via res.json(...), and on failure the upstream error string is reflected verbatim as ESRI Server Error: . An attacker can read cloud metadata (and the temporary IAM credentials the instance role exposes), enumerate internal services, and exfiltrate their response bodies. The sniff() URL classifier provides no protection: it only pattern-matches the pathname (/rest, /arcgis/rest, /sharing/rest), so a URL like http://169.254.169.254/arcgis/rest or http://127.0.0.1:8500/rest passes sniff() and is fetched. This issue has been patched in version 13.10.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55177.json"
}
References

Affected packages

Git / github.com/dfpc-coe/cloudtak

Affected ranges

Type
GIT
Repo
https://github.com/dfpc-coe/cloudtak
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
145d0b284ae4b8a96b8f80377d9efd167d5af0b2
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "13.10.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v1.*
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.12.1
v1.13.0
v1.14.0
v1.15.0
v1.15.1
v1.16.0
v1.17.0
v1.17.1
v1.17.2
v1.17.3
v1.17.4
v1.18.0
v1.19.0
v1.19.1
v1.20.0
v1.20.1
v1.21.0
v1.21.1
v1.22.0
v1.22.1
v1.22.2
v1.22.3
v1.23.0
v1.23.1
v1.23.2
v1.24.0
v1.24.1
v1.25.0
v1.25.1
v1.26.0
v1.27.0
v1.28.0
v1.28.1
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.4.0
v1.4.1
v1.4.2
v1.5.0
v1.6.0
v1.6.1
v1.7.0
v1.8.0
v1.9.0
v10.*
v10.0.0
v10.0.1
v10.1.0
v10.10.0
v10.11.0
v10.12.0
v10.13.0
v10.14.0
v10.15.0
v10.16.0
v10.17.0
v10.18.0
v10.19.0
v10.2.0
v10.2.1
v10.2.2
v10.20.0
v10.20.1
v10.21.0
v10.21.1
v10.22.0
v10.22.1
v10.23.0
v10.24.0
v10.25.0
v10.26.0
v10.26.1
v10.27.0
v10.28.0
v10.29.0
v10.3.0
v10.30.0
v10.31.0
v10.32.0
v10.32.1
v10.32.2
v10.33.0
v10.33.1
v10.34.0
v10.35.0
v10.35.1
v10.36.0
v10.36.1
v10.37.0
v10.38.0
v10.39.0
v10.4.0
v10.40.0
v10.41.0
v10.42.0
v10.43.0
v10.44.0
v10.44.1
v10.45.0
v10.45.1
v10.45.2
v10.46.0
v10.47.0
v10.47.1
v10.48.0
v10.49.0
v10.5.0
v10.50.0
v10.51.0
v10.51.1
v10.51.2
v10.6.0
v10.7.0
v10.8.0
v10.9.0
v11.*
v11.0.0
v11.0.1
v11.0.2
v11.1.0
v11.1.1
v11.10.0
v11.11.0
v11.11.1
v11.11.2
v11.11.3
v11.11.4
v11.12.0
v11.12.1
v11.12.2
v11.13.0
v11.13.1
v11.13.2
v11.13.3
v11.14.0
v11.14.1
v11.15.0
v11.15.1
v11.15.2
v11.15.3
v11.16.0
v11.17.0
v11.17.1
v11.17.2
v11.17.3
v11.18.0
v11.18.1
v11.18.2
v11.18.3
v11.19.0
v11.2.0
v11.2.1
v11.2.2
v11.2.3
v11.2.4
v11.20.0
v11.21.0
v11.22.0
v11.23.0
v11.24.0
v11.25.0
v11.26.0
v11.27.0
v11.27.1
v11.27.2
v11.27.3
v11.27.4
v11.28.0
v11.28.1
v11.28.2
v11.28.3
v11.28.4
v11.29.0
v11.3.0
v11.30.0
v11.31.0
v11.32.0
v11.33.0
v11.33.1
v11.33.2
v11.33.3
v11.33.4
v11.33.5
v11.34.0
v11.35.0
v11.36.0
v11.37.0
v11.38.0
v11.39.0
v11.4.0
v11.40.0
v11.41.0
v11.42.0
v11.42.1
v11.42.2
v11.42.3
v11.43.0
v11.45.0
v11.46.0
v11.47.0
v11.48.0
v11.49.0
v11.5.0
v11.50.0
v11.51.0
v11.52.0
v11.53.0
v11.53.1
v11.7.0
v11.8.0
v11.8.1
v11.9.0
v11.9.1
v12.*
v12.0.0
v12.0.1
v12.0.2
v12.0.3
v12.1.0
v12.10.0
v12.100.0
v12.100.1
v12.101.0
v12.102.0
v12.102.1
v12.102.2
v12.102.3
v12.103.0
v12.103.1
v12.103.2
v12.104.0
v12.104.1
v12.104.2
v12.105.0
v12.105.1
v12.105.2
v12.106.0
v12.106.1
v12.107.0
v12.108.0
v12.109.0
v12.11.1
v12.11.2
v12.11.3
v12.11.4
v12.11.5
v12.110.0
v12.111.0
v12.111.1
v12.112.0
v12.113.0
v12.114.0
v12.116.0
v12.116.1
v12.116.3
v12.117.0
v12.117.1
v12.118.0
v12.119.0
v12.119.1
v12.12.0
v12.12.1
v12.120.0
v12.121.0
v12.122.0
v12.123.0
v12.124.0
v12.124.1
v12.125.0
v12.126.0
v12.127.0
v12.127.1
v12.127.2
v12.127.3
v12.128.0
v12.129.0
v12.13.0
v12.130.0
v12.131.0
v12.132.0
v12.133.0
v12.134.0
v12.135.0
v12.136.0
v12.137.0
v12.138.0
v12.138.2
v12.14.0
v12.15.0
v12.15.1
v12.15.2
v12.15.3
v12.15.4
v12.15.5
v12.16.0
v12.17.0
v12.17.1
v12.18.0
v12.19.0
v12.2.0
v12.2.1
v12.2.2
v12.20.0
v12.21.0
v12.22.0
v12.22.1
v12.23.0
v12.24.0
v12.24.1
v12.24.2
v12.25.0
v12.25.1
v12.26.0
v12.27.0
v12.27.1
v12.27.2
v12.28.0
v12.29.0
v12.3.0
v12.3.1
v12.3.2
v12.30.0
v12.31.0
v12.32.0
v12.33.0
v12.33.1
v12.33.2
v12.34.0
v12.35.0
v12.36.0
v12.37.0
v12.39.0
v12.4.0
v12.4.1
v12.40.0
v12.41.0
v12.42.0
v12.43.0
v12.44.0
v12.44.1
v12.45.0
v12.46.0
v12.47.0
v12.47.1
v12.47.2
v12.48.0
v12.49.0
v12.5.0
v12.5.1
v12.50.0
v12.51.0
v12.51.1
v12.51.2
v12.52.0
v12.53.0
v12.53.1
v12.54.0
v12.55.0
v12.55.1
v12.56.0
v12.57.0
v12.58.0
v12.59.0
v12.59.1
v12.6.0
v12.60.0
v12.61.0
v12.61.1
v12.62.0
v12.62.1
v12.63.0
v12.64.0
v12.65.0
v12.66.0
v12.67.0
v12.67.1
v12.67.2
v12.67.3
v12.68.0
v12.68.1
v12.69.0
v12.69.1
v12.7.0
v12.70.0
v12.71.1
v12.72.0
v12.72.1
v12.73.0
v12.73.1
v12.74.0
v12.75.0
v12.75.1
v12.75.2
v12.75.3
v12.75.4
v12.75.5
v12.76.0
v12.76.1
v12.76.2
v12.77.0
v12.77.1
v12.77.2
v12.77.3
v12.78.0
v12.79.0
v12.8.0
v12.80.0
v12.81.0
v12.81.1
v12.81.2
v12.82.0
v12.83.0
v12.84.0
v12.85.0
v12.86.0
v12.87.0
v12.87.1
v12.87.2
v12.87.3
v12.87.4
v12.88.0
v12.89.0
v12.89.1
v12.9.0
v12.90.0
v12.90.1
v12.91.0
v12.91.1
v12.92.0
v12.93.0
v12.94.0
v12.95.0
v12.95.1
v12.95.2
v12.96.0
v12.96.1
v12.97.0
v12.98.0
v12.99.0
v12.99.1
v13.*
v13.0.0
v13.0.1
v13.0.2
v13.1.0
v13.1.1
v13.2.0
v13.3.0
v13.4.0
v13.5.0
v13.6.0
v13.7.0
v13.8.0
v13.9.0
v2.*
v2.0.0
v2.1.0
v2.10.0
v2.11.0
v2.12.0
v2.13.0
v2.13.1
v2.14.0
v2.15.0
v2.16.0
v2.17.0
v2.17.1
v2.17.2
v2.17.3
v2.17.4
v2.17.5
v2.17.6
v2.18.0
v2.18.1
v2.18.2
v2.19.0
v2.2.0
v2.2.1
v2.20.0
v2.21.0
v2.22.0
v2.23.0
v2.24.0
v2.25.0
v2.26.0
v2.27.0
v2.27.1
v2.27.2
v2.27.3
v2.28.0
v2.28.1
v2.29.0
v2.3.0
v2.30.0
v2.30.1
v2.31.0
v2.32.0
v2.33.0
v2.34.0
v2.35.0
v2.36.0
v2.36.1
v2.37.0
v2.37.1
v2.37.2
v2.37.3
v2.37.4
v2.37.5
v2.37.6
v2.37.7
v2.38.0
v2.39.0
v2.4.0
v2.40.0
v2.41.0
v2.42.0
v2.43.0
v2.44.0
v2.45.0
v2.46.0
v2.47.0
v2.47.1
v2.47.2
v2.48.0
v2.49.0
v2.5.0
v2.50.0
v2.51.0
v2.52.0
v2.53.0
v2.53.1
v2.54.0
v2.55.0
v2.56.0
v2.57.0
v2.58.0
v2.59.0
v2.59.1
v2.6.0
v2.6.1
v2.60.0
v2.61.0
v2.61.1
v2.61.2
v2.62.0
v2.63.0
v2.64.0
v2.64.1
v2.65.0
v2.66.0
v2.67.0
v2.67.1
v2.67.2
v2.69.0
v2.7.0
v2.7.1
v2.7.2
v2.7.3
v2.70.0
v2.70.1
v2.70.2
v2.70.3
v2.71.0
v2.73.0
v2.73.1
v2.74.0
v2.75.0
v2.75.1
v2.76.0
v2.77.0
v2.78.0
v2.78.1
v2.79.0
v2.8.0
v2.8.1
v2.8.2
v2.80.0
v2.80.1
v2.80.2
v2.80.3
v2.81.0
v2.82.0
v2.83.0
v2.83.1
v2.84.0
v2.85.0
v2.85.1
v2.85.2
v2.85.3
v2.86.0
v2.87.2
v2.88.0
v2.89.0
v2.9.0
v2.90.0
v2.91.0
v2.92.0
v2.92.1
v2.93.0
v2.94.0
v2.95.0
v2.96.0
v2.97.0
v2.98.0
v3.*
v3.0.0
v3.0.1
v3.10.0
v3.10.1
v3.11.0
v3.11.1
v3.11.2
v3.12.0
v3.13.0
v3.13.1
v3.14.0
v3.14.1
v3.15.0
v3.16.0
v3.16.1
v3.16.2
v3.17.0
v3.18.0
v3.19.0
v3.2.0
v3.20.0
v3.20.1
v3.20.2
v3.20.3
v3.21.0
v3.21.1
v3.22.0
v3.23.0
v3.24.0
v3.25.0
v3.25.1
v3.26.0
v3.27.0
v3.28.0
v3.29.0
v3.30.0
v3.31.0
v3.32.0
v3.33.0
v3.34.0
v3.35.0
v3.35.1
v3.36.0
v3.37.0
v3.38.0
v3.38.1
v3.38.2
v3.4.0
v3.5.0
v3.6.0
v3.7.0
v3.8.0
v3.9.0
v3.9.1
v4.*
v4.10.0
v4.11.0
v4.12.0
v4.13.0
v4.14.0
v4.15.0
v4.15.1
v4.16.0
v4.17.0
v4.18.0
v4.18.1
v4.19.0
v4.19.1
v4.19.2
v4.2.0
v4.20.0
v4.22.0
v4.23.0
v4.24.0
v4.25.0
v4.26.0
v4.27.0
v4.28.0
v4.29.0
v4.3.0
v4.30.0
v4.31.0
v4.31.1
v4.32.0
v4.33.0
v4.34.0
v4.35.0
v4.36.0
v4.37.0
v4.4.0
v4.4.1
v4.4.2
v4.5.0
v4.5.1
v4.6.0
v4.7.0
v4.8.0
v4.9.0
v5.*
v5.0.0
v5.0.1
v5.0.2
v5.1.0
v5.10.0
v5.11.0
v5.12.0
v5.13.0
v5.14.0
v5.15.0
v5.16.0
v5.2.0
v5.23.0
v5.25.0
v5.26.0
v5.27.0
v5.28.0
v5.29.0
v5.3.0
v5.30.0
v5.31.0
v5.32.0
v5.33.0
v5.34.0
v5.35.0
v5.36.0
v5.37.0
v5.38.0
v5.39.0
v5.4.0
v5.40.0
v5.41.0
v5.42.0
v5.43.0
v5.43.1
v5.43.2
v5.44.0
v5.45.0
v5.46.0
v5.47.0
v5.48.0
v5.48.1
v5.48.2
v5.5.0
v5.6.0
v5.7.0
v5.8.0
v5.9.0
v6.*
v6.0.0
v6.0.1
v6.1.0
v6.10.0
v6.11.0
v6.12.0
v6.12.1
v6.13.0
v6.2.0
v6.3.0
v6.4.0
v6.5.0
v6.6.0
v6.7.0
v6.7.1
v6.8.0
v6.8.1
v6.8.2
v6.9.0
v6.9.1
v7.*
v7.0.0
v7.1.0
v7.10.0
v7.11.0
v7.12.0
v7.13.0
v7.14.0
v7.15.0
v7.16.0
v7.17.0
v7.18.0
v7.18.1
v7.18.2
v7.19.0
v7.2.0
v7.20.0
v7.20.1
v7.20.2
v7.21.0
v7.22.0
v7.23.0
v7.24.0
v7.25.0
v7.25.1
v7.25.2
v7.25.3
v7.25.4
v7.25.5
v7.26.0
v7.27.0
v7.28.0
v7.29.0
v7.3.0
v7.30.0
v7.30.1
v7.30.2
v7.31.0
v7.32.0
v7.33.0
v7.33.1
v7.4.0
v7.5.0
v7.6.0
v7.6.1
v7.7.0
v7.8.0
v7.9.0
v8.*
v8.0.0
v8.1.0
v8.10.0
v8.10.1
v8.11.0
v8.12.0
v8.13.0
v8.14.0
v8.15.0
v8.16.0
v8.17.0
v8.18.0
v8.19.0
v8.19.1
v8.2.0
v8.20.0
v8.21.0
v8.22.0
v8.23.0
v8.24.0
v8.25.0
v8.26.0
v8.27.0
v8.27.1
v8.28.0
v8.29.0
v8.3.0
v8.3.1
v8.3.2
v8.3.3
v8.30.0
v8.31.0
v8.31.1
v8.31.2
v8.31.3
v8.32.0
v8.32.1
v8.32.2
v8.32.3
v8.32.4
v8.33.0
v8.34.0
v8.35.0
v8.35.1
v8.36.0
v8.37.0
v8.38.0
v8.39.0
v8.4.0
v8.40.0
v8.41.0
v8.42.0
v8.43.0
v8.43.1
v8.44.0
v8.45.0
v8.45.1
v8.45.2
v8.5.0
v8.6.0
v8.7.0
v8.8.0
v8.9.0
v8.9.1
v8.9.2
v9.*
v9.0.0
v9.1.0
v9.2.0
v9.3.0
v9.3.1
v9.3.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55177.json"