{"vulnerability": "CVE-2026-91129", "sightings": [{"uuid": "30978f45-81db-49af-83d7-7ed924881936", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91129", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/24c3ejk3m5ej4", "content": "CVE-2026-91129 - Home Assistant: mDNS Server-Side Request Forgery\nCVE ID : CVE-2026-91129\n \n Published : Sept. 22, 2026, 7:05 p.m. | 23\u00a0minutes ago\n \n Description : Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, ...", "creation_timestamp": "2026-09-22T20:22:52.270564Z"}, {"uuid": "278ae062-824b-4b32-84ed-021a799448be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91129", "type": "seen", "source": "https://gist.github.com/alon710/514237596aac504f5f1548b022761aec", "content": "# CVE-2026-91129: CVE-2026-91129: Server-Side Request Forgery in Home Assistant Core IPP Integration\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-91129\n\n## Summary\nHome Assistant Core prior to version 2026.2.3 is vulnerable to Server-Side Request Forgery (SSRF) via the IPP integration's auto-discovery mechanism. Unauthenticated mDNS advertisements can trigger HTTP requests that follow malicious redirects to loopback interfaces.\n\n## TL;DR\nAn unauthenticated adjacent attacker can exploit the IPP auto-discovery mechanism in Home Assistant Core to conduct SSRF attacks, potentially accessing local loopback interfaces or internal services.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Adjacent Network (AV:A)\n- **CVSS Score**: 5.4\n- **EPSS Score**: N/A (Pending)\n- **Impact**: Confidentiality and Integrity Bypass via SSRF\n- **Exploit Status**: Proof of Concept / Conceptual\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Home Assistant Core prior to 2026.2.3\n- Home Assistant Green installations prior to core update 2026.2.3\n- Any Home Assistant deployment utilizing the IPP auto-discovery integration\n- **Core**: < 2026.2.3 (Fixed in: `2026.2.3`)\n\n## Mitigation\n\n- Upgrade Home Assistant Core to 2026.2.3 or newer\n- Segment IoT devices onto an isolated VLAN\n- Disable mDNS reflection between untrusted networks and the Home Assistant network\n\n**Remediation Steps:**\n1. Identify the current running Home Assistant version.\n2. Navigate to Settings -> System -> Updates.\n3. Select the update to version 2026.2.3 or newer and apply it.\n4. Verify that the IPP integration is operating securely and no unauthorized mDNS entries are processed.\n\n## References\n\n- [Home Assistant Core GHSA](https://github.com/home-assistant/core/security/advisories/GHSA-4ghv-53cq-7wp3)\n- [Home Assistant Core PR 162941](https://github.com/home-assistant/core/pull/162941)\n- [CVE Record CVE-2026-91129](https://www.cve.org/CVERecord?id=CVE-2026-91129)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-91129) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-22T22:31:58.914669Z"}, {"uuid": "4d0a9d8b-9d8d-45f2-89bf-bb0c578720ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-91129", "type": "published-proof-of-concept", "source": "https://github.com/home-assistant/core/security/advisories/GHSA-4ghv-53cq-7wp3", "content": "", "creation_timestamp": "2026-09-22T22:35:04.491320Z"}]}