CVE-2026-91129: Server-Side Request Forgery in Home Assistant Core IPP Integration
Vulnerability ID: CVE-2026-91129
CVSS Score: 5.4
Published: 2026-09-22
Home Assistant Core prior to version 2026.2.3 is vulnerable to Server-Side Request Forgery (SSRF) via the IPP integration's auto-discovery mechanism. Unauthenticated mDNS advertisements can trigger HTTP requests that follow malicious redirects to loopback interfaces.
TL;DR
An unauthenticated adjacent attacker can exploit the IPP auto-discovery mechanism in Home Assistant Core to conduct SSRF attacks, potentially accessing local loopback interfaces or internal services.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-918
- Attack Vector: Adjacent Network (AV:A)
- CVSS Score: 5.4
- EPSS Score: N/A (Pending)
- Impact: Confidentiality and Integrity Bypass via SSRF
- Exploit Status: Proof of Concept / Conceptual
- CISA KEV Status: Not Listed
Affected Systems
- Home Assistant Core prior to 2026.2.3
- Home Assistant Green installations prior to core update 2026.2.3
- Any Home Assistant deployment utilizing the IPP auto-discovery integration
-
Core: < 2026.2.3 (Fixed in:
2026.2.3)
Code Analysis
Commit: 0f3c7ca
Implement redirect loopback checks in client sessions
Commit: 815c708
Refactor aiohttp redirect protection to handle trailing dots and host resolution
Mitigation Strategies
- Upgrade Home Assistant Core to 2026.2.3 or newer
- Segment IoT devices onto an isolated VLAN
- Disable mDNS reflection between untrusted networks and the Home Assistant network
Remediation Steps:
- Identify the current running Home Assistant version.
- Navigate to Settings -> System -> Updates.
- Select the update to version 2026.2.3 or newer and apply it.
- Verify that the IPP integration is operating securely and no unauthorized mDNS entries are processed.
References
Read the full report for CVE-2026-91129 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)