Information Disclosure via Publicly Exposed tRPC Endpoint in Homarr Dashboard

Compliance Impact

I don't know

Useful 0 Not Useful 0

Executive Summary

CVE-2026-27796 is an information disclosure vulnerability in the open-source dashboard Homarr, affecting versions prior to 1.54.0.

The vulnerability arises because the integration.all tRPC endpoint was exposed as a publicProcedure, meaning it did not require authentication.

This allowed unauthenticated users to retrieve a complete list of configured integrations, including sensitive metadata such as internal service URLs, integration names, and service types.

This exposure leaks internal network topology and service discovery information, which could be used for further targeted attacks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by exposing sensitive internal information about your Homarr integrations to unauthenticated users.

• Leakage of internal service URLs, including IP addresses and hostnames.
• Disclosure of integration names and service types.
• Exposure of internal network topology and service discovery details.

Such information disclosure increases the risk of targeted attacks against your internal services by malicious actors.

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by attempting to access the vulnerable integration.all tRPC endpoint without authentication and observing if it returns sensitive integration data.'}, {'type': 'paragraph', 'content': 'A suggested command to test this is a curl GET request to the endpoint, which if successful, returns a JSON array of configured integrations including sensitive internal URLs and service information.'}, {'type': 'list_item', 'content': 'curl -G \'http://127.0.0.1:7575/api/trpc/integration.all\' --data-urlencode \'batch=1\' --data-urlencode \'input={"0":{"json":null,"meta":{"values":["undefined"]}}}\''}] [2]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'To mitigate this vulnerability immediately, upgrade Homarr to version 1.54.0 or later, where the integration.all endpoint and related API procedures have been changed from public to protected, enforcing authentication.'}, {'type': 'paragraph', 'content': 'This patch restricts access to integration-related API endpoints and UI components exclusively to authenticated users, preventing unauthenticated information disclosure.'}, {'type': 'list_item', 'content': "Apply the patch that changes the integration router's API procedures from publicProcedure to protectedProcedure."}, {'type': 'list_item', 'content': 'Ensure that the frontend components use session-based authentication to hide integration menus from unauthenticated users.'}] [1]

Useful 0 Not Useful 0