CVE-2026-91129Medium· 5.4▾ TwilightPoC availableHome Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated _ipp._tcp.local mDNS announcements in homeassistant/components/ip…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Exploit / PoC code exists
Last analysed / modified upstream
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated _ipp._tcp.local mDNS announcements in homeassistant/components/ipp/config_flow.py, where async_step_zeroconf passed attacker-controlled host, port, and base_path values to validate_input for printer metadata retrieval. Because the shared HTTP client followed attacker-controlled cross-origin redirects without blocking loopback targets, a local-network attacker could redirect the request to 127.0.0.1 or another internal service without user interaction or prior IPP configuration. This issue is fixed in version 2026.2.3.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
homeassistant < 2026.2.2Patched in:
homeassistant 2026.2.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-64825Critical· 9.3Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial o…
CVE-2026-53582High· 7.1OPNsense is a FreeBSD based firewall and routing platform
CVE-2026-58391Medium· 5.4OPNsense is a FreeBSD based firewall and routing platform
CVE-2026-58393Medium· 5.9OPNsense is a FreeBSD based firewall and routing platform
CVE-2026-58395Medium· 4.3OPNsense is a FreeBSD based firewall and routing platform
CVE-2026-58390High· 8.0OPNsense is a FreeBSD based firewall and routing platform