cyfenced.com →

[ CVE-2026-91129 · Published 22 Sep 2026 ]

Home Assistant: mDNS Server-Side Request Forgery

CVSS 5.4 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated _ipp._tcp.local mDNS announcements in homeassistant/components/ipp/config_flow.py, where async_step_zeroconf passed attacker-controlled host, port, and base_path values to validate_input for printer metadata retrieval. Because the shared HTTP client followed attacker-controlled cross-origin redirects without blocking loopback targets, a local-network attacker could redirect the request to 127.0.0.1 or another internal service without user interaction or prior IPP configuration. This issue is fixed in version 2026.2.3.

[ Fixes ]Fixes and patches

  • homeassistant 2026.2.3Fixed version · GitHub Advisories · pip package homeassistant: upgrade to 2026.2.3 or later (affected < 2026.2.2)

[ Packages ]Affected open-source packages

[ References ]References