Vulnerability · Published Mar 7, 2026 · Assigned by GitHub_M

CVE-2026-27796Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak)

Medium 5.3

In plain English

A medium-severity information exposure in homarr from homarr-labs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)1.3%top 30.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthenticated users to retrieve a complete list of configured integrations. This metadata includes sensitive information such as internal service URLs, integration names, and service types. This issue has been patched in version 1.54.0.

Affected products (as reported)

Vendor	Product	Versions
homarr-labs	homarr	< 1.54.0

Weakness: CWE-200, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/homarr-labs/homarr/security/advisories/GHSA-m4vc-4prp-cvp7 x_refsource_CONFIRM
https://github.com/homarr-labs/homarr/commit/91fc5a5c747121475a50f2713d571ceb89e95257 x_refsource_MISC
https://github.com/homarr-labs/homarr/releases/tag/v1.54.0 x_refsource_MISC