CVE-2026-91129: Home Assistant SSRF Vulnerability via mDNS Integration
Summary
CVE-2026-91129: Home Assistant: mDNS Server-Side Request Forgery. Affects homeassistant versions < 2026.2.3. Fixed in 2026.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Home Assistant is an open-source home automation platform that focuses on privacy and local control. It allows users to control smart home devices and automate tasks through a web interface. The platform supports various integrations, including mDNS/Zeroconf for device discovery. However, a vulnerability in the IPP integration exposes it to Server-Side Request Forgery (SSRF) attacks, enabling unauthorized access to internal services.
Vulnerability Detail
The vulnerability arises from the Home Assistant Green's mDNS/Zeroconf IPP integration, which processes service announcements without proper validation. An unauthenticated attacker on the same local network can send a crafted mDNS response, tricking Home Assistant into making HTTP requests to arbitrary hosts, including internal services bound to localhost. The integration automatically follows HTTP redirects from the attacker-controlled host, allowing the attacker to coerce Home Assistant into issuing requests to internal endpoints that would otherwise be inaccessible.
How To Fix
Latest published version: 2026.10.2 as of 22 Oct 2026
pip install --upgrade "homeassistant==2026.10.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.2.3
This is the first release that contains the fix.
pip install --upgrade "homeassistant==2026.2.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the mDNS/Zeroconf IPP integration until you can apply the patch. This can be done by removing or commenting out the relevant configuration in your Home Assistant configuration files.
Conclusion
CVE-2026-91129 is a significant vulnerability in the Home Assistant platform that allows SSRF attacks via the mDNS/Zeroconf IPP integration. Users are strongly advised to update to the patched version 2026.2.3 or later to mitigate the risk. Additionally, temporary workarounds are available to enhance security until the update can be applied.
See every vulnerability recorded for homeassistant →
FAQ
CVE-2026-91129 is a vulnerability in Home Assistant that allows an unauthenticated attacker on the local network to exploit the mDNS/Zeroconf IPP integration, leading to Server-Side Request Forgery (SSRF).
If you are using a version of Home Assistant prior to 2026.2.3, your installation is vulnerable to this SSRF attack. You can check your version in the Home Assistant interface or by running 'pip show homeassistant'.
An attacker can use this vulnerability to make HTTP requests to internal services, potentially exposing sensitive data or allowing unauthorized actions on those services.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. Vulert can analyze your Pipfile.lock to identify if your application is affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for homeassistant.
