The vulnerability allows an authenticated user to supply an arbitrary URL to CloudTAK’s ESRI helper routes, which the server then requests without any host or IP validation. The full‑read SSRF returns the remote response or error message directly to the attacker, providing visible data from internal endpoints. The issue is classified as CVSS 7.6, indicating substantial impact on confidentiality and availability when exploited.

dfpc‑coe CloudTAK versions prior to 13.10.0 are affected. Any user possessing a valid authentication token can trigger the vulnerable routes; the policy does not require admin rights. The vulnerability applies to all ESRI helper routes under /api/esri*, including POST /api/esri and GET /api/esri/{portal|server|layer}.

The CVSS score of 7.6 signifies a high risk. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that it is not a known actively exploited threat yet. Nonetheless, because the bug permits direct reading of internal services such as the instance‑metadata endpoint and local admin ports, an attacker can enumerate internal resources, retrieve temporary IAM credentials, and exfiltrate data. The attack vector requires only authentication, which means any authorized user can perform the SSRF. Preventing abuse relies on blocking outbound traffic to internal ranges or re‑authorizing access to the helper routes.