CVE-2026-91129
mediumHome Assistant is open source home automation software focused on local control and privacy.
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated _ipp._tcp.local mDNS announcements in homeassistant/components/ipp/config_flow.py, where async_step_zeroconf passed attacker-controlled host, port, and base_path values to validate_input for printer metadata retrieval. Because the shared HTTP client followed attacker-controlled cross-origin redirects without blocking loopback targets, a local-network attacker could redirect the request to 127.0.0.1 or another internal service without user interaction or prior IPP configuration. This issue is fixed in version 2026.2.3.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/home-assistant/core/commit/0f3c7ca2772b605c0f3c09c88f35e527ea6ea560 security-advisories@github.com
- https://github.com/home-assistant/core/commit/815c708d19aa0c7f59f9ee318b613a5e481a42b3 security-advisories@github.com
- https://github.com/home-assistant/core/pull/162941 security-advisories@github.com
- https://github.com/home-assistant/core/releases/tag/2026.2.3 security-advisories@github.com
- https://github.com/home-assistant/core/security/advisories/GHSA-4ghv-53cq-7wp3 security-advisories@github.com
- https://github.com/home-assistant/core/security/advisories/GHSA-4ghv-53cq-7wp3 134c704f-9b21-4f2e-91b3-4a467353bcc0