CVE-2026-34205

Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (formerly add-ons) configured with host network mode expose unauthenticated endpoints bound to the internal Docker bridge interface to the local network. On Linux, this configuration does not restrict access to the app as intended, allowing any device on the same network to reach these endpoints without authentication. Home Assistant Supervisor 2026.03.02 addresses the issue.

CVSS v3 9.6 CRITICAL

9.6^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.8 / Impact : 6.0

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/home-assistant/core/security/advisories/GHSA-gh5m-4m97-c95h

Configurations

No configuration.

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Home Assistant es un software de automatización del hogar de código abierto que prioriza el control local y la privacidad. Las aplicaciones de Home Assistant (anteriormente complementos) configuradas con el modo de red de host exponen puntos finales no autenticados vinculados a la interfaz de puente interna de Docker a la red local. En Linux, esta configuración no restringe el acceso a la aplicación como se pretendía, permitiendo que cualquier dispositivo en la misma red alcance estos puntos finales sin autenticación. Home Assistant Supervisor 2026.03.02 aborda el problema.

Information

Published : 2026-03-27 20:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-34205

Mitre link : CVE-2026-34205

CVE.ORG link : CVE-2026-34205

JSON object : View

Products Affected

No product.

CWE

CWE-923

Improper Restriction of Communication Channel to Intended Endpoints

{"id": "CVE-2026-34205", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34205", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-31T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "home-assistant", "product": "Home Assistant Operating System", "versions": [{"status": "affected", "version": "<= 17.1"}]}, {"vendor": "home-assistant", "product": "Home Assistant Supervisor", "versions": [{"status": "affected", "version": "< 2026.03.2"}]}]}], "published": "2026-03-27T20:16:35.360", "references": [{"url": "https://github.com/home-assistant/core/security/advisories/GHSA-gh5m-4m97-c95h", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-923"}]}], "descriptions": [{"lang": "en", "value": "Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (formerly add-ons) configured with host network mode expose unauthenticated endpoints bound to the internal Docker bridge interface to the local network. On Linux, this configuration does not restrict access to the app as intended, allowing any device on the same network to reach these endpoints without authentication. Home Assistant Supervisor 2026.03.02 addresses the issue."}, {"lang": "es", "value": "Home Assistant es un software de automatizaci\u00f3n del hogar de c\u00f3digo abierto que prioriza el control local y la privacidad. Las aplicaciones de Home Assistant (anteriormente complementos) configuradas con el modo de red de host exponen puntos finales no autenticados vinculados a la interfaz de puente interna de Docker a la red local. En Linux, esta configuraci\u00f3n no restringe el acceso a la aplicaci\u00f3n como se pretend\u00eda, permitiendo que cualquier dispositivo en la misma red alcance estos puntos finales sin autenticaci\u00f3n. Home Assistant Supervisor 2026.03.02 aborda el problema."}], "lastModified": "2026-10-26T22:10:00.163", "sourceIdentifier": "security-advisories@github.com"}