CVE-2026-91129: Home Assistant mDNS Server-Side Request Forgery Vulnerability
Summary
CVE-2026-91129: Home Assistant: mDNS Server-Side Request Forgery. Affects homeassistant versions < 2026.2.3. Fixed in 2026.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Home Assistant is an open-source home automation platform that focuses on privacy and local control. It allows users to control smart home devices and automate tasks. The platform supports various integrations, including mDNS/Zeroconf for discovering devices on the local network. However, a vulnerability has been identified in the mDNS IPP integration that exposes the system to Server-Side Request Forgery (SSRF) attacks.
Vulnerability Detail
Home Assistant Green is vulnerable to a Server-Side Request Forgery (SSRF) via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal services bound to localhost. The vulnerability arises because the IPP integration processes mDNS service announcements automatically without validation, allowing attackers to exploit this behavior to redirect requests to internal services.
How To Fix
Latest published version: 2026.10.2 as of 22 Oct 2026
pip install --upgrade "homeassistant==2026.10.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.2.3
This is the first release that contains the fix.
pip install --upgrade "homeassistant==2026.2.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the mDNS/Zeroconf IPP integration until the package is updated. This can be done by removing or commenting out the relevant configuration in the Home Assistant configuration file.
Conclusion
The CVE-2026-91129 vulnerability in Home Assistant poses a significant risk due to its potential for SSRF attacks via the mDNS IPP integration. Users are encouraged to update to the latest version to mitigate this risk and ensure the security of their home automation systems.
See every vulnerability recorded for homeassistant →
FAQ
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
An unauthenticated attacker on the same local network can exploit this vulnerability.
The attacker can coerce Home Assistant into issuing HTTP requests to arbitrary hosts, including internal services that are not otherwise reachable.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a service that monitors and alerts in real-time for open-source vulnerabilities in software, using just the Pipfile.lock to track vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for homeassistant.
