{"uuid": "278ae062-824b-4b32-84ed-021a799448be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91129", "type": "seen", "source": "https://gist.github.com/alon710/514237596aac504f5f1548b022761aec", "content": "# CVE-2026-91129: CVE-2026-91129: Server-Side Request Forgery in Home Assistant Core IPP Integration\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-91129\n\n## Summary\nHome Assistant Core prior to version 2026.2.3 is vulnerable to Server-Side Request Forgery (SSRF) via the IPP integration's auto-discovery mechanism. Unauthenticated mDNS advertisements can trigger HTTP requests that follow malicious redirects to loopback interfaces.\n\n## TL;DR\nAn unauthenticated adjacent attacker can exploit the IPP auto-discovery mechanism in Home Assistant Core to conduct SSRF attacks, potentially accessing local loopback interfaces or internal services.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Adjacent Network (AV:A)\n- **CVSS Score**: 5.4\n- **EPSS Score**: N/A (Pending)\n- **Impact**: Confidentiality and Integrity Bypass via SSRF\n- **Exploit Status**: Proof of Concept / Conceptual\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Home Assistant Core prior to 2026.2.3\n- Home Assistant Green installations prior to core update 2026.2.3\n- Any Home Assistant deployment utilizing the IPP auto-discovery integration\n- **Core**: < 2026.2.3 (Fixed in: `2026.2.3`)\n\n## Mitigation\n\n- Upgrade Home Assistant Core to 2026.2.3 or newer\n- Segment IoT devices onto an isolated VLAN\n- Disable mDNS reflection between untrusted networks and the Home Assistant network\n\n**Remediation Steps:**\n1. Identify the current running Home Assistant version.\n2. Navigate to Settings -> System -> Updates.\n3. Select the update to version 2026.2.3 or newer and apply it.\n4. Verify that the IPP integration is operating securely and no unauthorized mDNS entries are processed.\n\n## References\n\n- [Home Assistant Core GHSA](https://github.com/home-assistant/core/security/advisories/GHSA-4ghv-53cq-7wp3)\n- [Home Assistant Core PR 162941](https://github.com/home-assistant/core/pull/162941)\n- [CVE Record CVE-2026-91129](https://www.cve.org/CVERecord?id=CVE-2026-91129)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-91129) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-22T22:31:58.914669Z"}