Read the docs
TI-2026-39212 Aliases CVE-2026-54317GHSA-x84v-g949-293w

Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN

Priority HIGH 66CWE-200Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-306.

Summary

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.6.0, the Konnected integration registers an HTTP endpoint, KonnectedView (homeassistant/components/konnected/__init__.py), that is marked as not requiring authentication (requires_auth = False). A comment next to that line says auth is instead handled "via the access token from configuration." That promise is only half true. Write requests (POST and PUT) are handled by update_sensor(), which does check the request's Authorization: Bearer <token> header against the integration's stored access tokens (using hmac.compare_digest). Read requests (GET) are handled by a separate get() method that has no authentication check at all. This vulnerability is fixed in 2026.6.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00308 23rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed core (home-assistant): 2026.6.0homeassistant (PyPI): 2026.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
home-assistantcorebefore 2026.6.02026.6.0Patch availableCNA
—homeassistant (PyPI)before 2026.6.02026.6.0Patch availableGHSA-x84v-g949-293w
  • core Vendorhome-assistant Affected before 2026.6.0 Fixed in 2026.6.0 Patch available CNA
  • homeassistant (PyPI) Vendor— Affected before 2026.6.0 Fixed in 2026.6.0 Patch available GHSA-x84v-g949-293w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:home-assistant:home-assistant:*:*:*:*:*:*:*:*before 2026.6.0Vulnerablehome-assistant
  • cpe:2.3:a:home-assistant:home-assistant:*:*:*:*:*:*:*:* Versions before 2026.6.0 Vulnerable ·home-assistant

Remediation

  • Fix · CNA core (home-assistant) Fixed in 2026.6.0
  • Fix · GHSA-x84v-g949-293w homeassistant (PyPI) Fixed in 2026.6.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54317
  2. 2026-10-03 Alias added: GHSA-x84v-g949-293w

References

Exploit 1

Advisory 1

Other 2

  • TI-2023-12210 Improper authentication in home-assistant core CVSS 3.1CRITICAL 10.0
  • TI-2026-25491 Home Assistant has stored XSS in history-graphs CVSS 4.0HIGH 7.3
  • TI-2026-25490 Home Assistant has stored XSS in Map-card through malicious device name CVSS 4.0HIGH 7.3
  • TI-2025-40423 Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. CVSS 3.1MEDIUM 4.0
  • TI-2023-22289 Lack of XFO header allows clickjacking in Home Assistant Core CVSS 3.1CRITICAL 9.6
  • TI-2023-22287 Cross-site Scripting via auth_callback login in Home Assistant Core CVSS 3.1CRITICAL 9.6
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences