CVE-2026-91129: Home Assistant: mDNS Server-Side Request Forgery
Home Assistant Green is vulnerable to a Server-Side Request Forgery (SSRF) via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal services bound to localhost. The IPP integration automatically processes _ipp._tcp.local service announcements without any user interaction or authentication, and follows HTTP redirects from the attacker-controlled host.
References
- github.com/advisories/GHSA-4ghv-53cq-7wp3
- github.com/home-assistant/core/commit/0f3c7ca2772b605c0f3c09c88f35e527ea6ea560
- github.com/home-assistant/core/commit/815c708d19aa0c7f59f9ee318b613a5e481a42b3
- github.com/home-assistant/core/pull/162941
- github.com/home-assistant/core/releases/tag/2026.2.3
- github.com/home-assistant/core/security/advisories/GHSA-4ghv-53cq-7wp3
- nvd.nist.gov/vuln/detail/CVE-2026-91129
Code Behaviors & Features
Detect and mitigate CVE-2026-91129 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →