Read the docs
TI-2026-26500 Aliases CVE-2026-34205

Home Assistant: Unauthenticated App (Add-on) Endpoints Exposed to Local Network via Host Network Mode

Priority MEDIUM 42CWE-923Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (formerly add-ons) configured with host network mode expose unauthenticated endpoints bound to the internal Docker bridge interface to the local network. On Linux, this configuration does not restrict access to the app as intended, allowing any device on the same network to reach these endpoints without authentication. Home Assistant Supervisor 2026.03.02 addresses the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00268 19th percentileScored 2026-11-07
Fix Fixed Home Assistant Supervisor (home-assistant): 2026.03.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
home-assistantHome Assistant Operating Systemup to 17.1—No fix listedCNA
home-assistantHome Assistant Supervisorbefore 2026.03.22026.03.2Patch availableCNA
  • Home Assistant Operating System Vendorhome-assistant Affected up to 17.1 Fixed in — No fix listed CNA
  • Home Assistant Supervisor Vendorhome-assistant Affected before 2026.03.2 Fixed in 2026.03.2 Patch available CNA

Remediation

  • Fix · CNA Home Assistant Supervisor (home-assistant) Fixed in 2026.03.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34205

References

Other 1

  • TI-2023-12210 Improper authentication in home-assistant core CVSS 3.1CRITICAL 10.0
  • TI-2021-22555 Home Assistant Community Store 1.10.0 Path Traversal Account Takeover CVSS 4.0HIGH 8.7
  • TI-2026-61899 Home Assistant: XSS in Statistics Graph Card CVSS 4.0CRITICAL 9.3
  • TI-2026-46349 Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore CVSS 4.0CRITICAL 9.3
  • TI-2026-40307 Cleartext transmission of sensitive information in home-assistant core CVSS 3.1HIGH 7.5
  • TI-2025-38490 Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name CVSS 4.0HIGH 8.5
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences