Detections
Analytics

SCA: security update for @tak-ps/cloudtak (GHSA-r95q-fp26-h3hc)

high Tenable Cloud Security Plugin ID 444837

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK.
 Prior to version 13.10.0, every route in the ESRI helper family (api/routes/esri.ts) takes a fully
 attacker-controlled URL from the request (POST /api/esri body url, and the portal / server / layer query
 parameters on the GET /api/esri/* routes) and passes it into EsriBase / EsriProxyPortal / EsriProxyServer
 / EsriProxyLayer in api/lib/esri.ts, which fetch it with the bare fetch from @tak-ps/etl. No IP / DNS /
 hostname classification is applied at any point, so the destination is never validated against private,
 loopback, or link-local ranges. Any authenticated user (the routes only require Auth.is_auth(config, req,
 { anyResources: true }), i.e. any token, not an admin) can therefore make the CloudTAK server issue
 arbitrary outbound GET/POST requests to internal addresses such as the cloud instance-metadata service
 (169.254.169.254), loopback admin ports (127.0.0.1:<port>), and other hosts reachable only from inside the
 deployment VPC. This is a full-read SSRF, not blind: on success the upstream JSON body is returned to the
 caller via res.json(...), and on failure the upstream error string is reflected verbatim as ESRI Server
 Error: <message>. An attacker can read cloud metadata (and the temporary IAM credentials the instance role
 exposes), enumerate internal services, and exfiltrate their response bodies. The sniff() URL classifier
 provides no protection: it only pattern-matches the pathname (/rest, /arcgis/rest, /sharing/rest), so a
 URL like http://169.254.169.254/arcgis/rest or http://127.0.0.1:8500/rest passes sniff() and is fetched.
 This issue has been patched in version 13.10.0. (CVE-2026-55177)

Solution

Update the @tak-ps/cloudtak library and its related packages to version 13.10.0 or later.

See Also

https://github.com/advisories/GHSA-r95q-fp26-h3hc

Plugin Details

Severity: High

ID: 444837

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 7/18/2026

Updated: 10/1/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS Score Source: CVE-2026-55177

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.6

Threat Score: 4.9

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/17/2026

Vulnerability Publication Date: 7/17/2026

Reference Information

CVE: CVE-2026-55177

cwe: CWE-918