CVE-2026-91129: Home Assistant: mDNS Server-Side Request Forgery
Home Assistant Green is vulnerable to a Server-Side Request Forgery (SSRF) via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal services bound to localhost. The IPP integration automatically processes _ipp._tcp.local service announcements without any user interaction or authentication, and follows HTTP redirects from the attacker-controlled host.
References
- github.com/advisories/GHSA-4ghv-53cq-7wp3
- github.com/home-assistant/core/commit/0f3c7ca2772b605c0f3c09c88f35e527ea6ea560
- github.com/home-assistant/core/commit/815c708d19aa0c7f59f9ee318b613a5e481a42b3
- github.com/home-assistant/core/pull/162941
- github.com/home-assistant/core/releases/tag/2026.2.3
- github.com/home-assistant/core/security/advisories/GHSA-4ghv-53cq-7wp3
- nvd.nist.gov/vuln/detail/CVE-2026-91129
Code Behaviors & Features
Detect and mitigate CVE-2026-91129 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →