Vulnerability · Published Mar 27, 2026 · Assigned by GitHub_M

CVE-2026-34205Home Assistant: Unauthenticated App (Add-on) Endpoints Exposed to Local Network via Host Network Mode

Critical 9.7

In plain English

A critical-severity security flaw in Home Assistant Operating System from home-assistant. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)9.7Critical

Exploit odds (30 days)0.3%top 81.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (formerly add-ons) configured with host network mode expose unauthenticated endpoints bound to the internal Docker bridge interface to the local network. On Linux, this configuration does not restrict access to the app as intended, allowing any device on the same network to reach these endpoints without authentication. Home Assistant Supervisor 2026.03.02 addresses the issue.

Affected products (as reported)

Vendor	Product	Versions
home-assistant	Home Assistant Operating System	<= 17.1
home-assistant	Home Assistant Supervisor	< 2026.03.2

Weakness: CWE-923 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/home-assistant/core/security/advisories/GHSA-gh5m-4m97-c95h x_refsource_CONFIRM