CVE-2026-53456

Received Received - Intake

SSH Key Exposure in Blueprint Studio

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in custom_components/blueprint_studio/backend/terminal_manager.py wrote SSH private-key material to a file under the Home Assistant configuration directory before applying restrictive permissions and relied on best-effort cleanup. The key could temporarily remain on disk and could persist if cleanup failed or Home Assistant crashed. A user or process with filesystem access to the Home Assistant configuration directory could obtain the residual private key. This issue is fixed in version 2.5.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-53456

Affected Vendors & Products

Vendor	Product	Version / Range
blueprint_studio	blueprint_studio	to 2.5.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

This vulnerability affects Blueprint Studio, a VS Code-like editor for Home Assistant configuration files. Before version 2.5.2, the software temporarily stored SSH private key material in a file within the Home Assistant configuration directory. It attempted to apply restrictive permissions and clean up the file afterward, but the key could remain accessible if cleanup failed or the system crashed. Attackers with filesystem access to the directory could retrieve the residual private key.

Detection Guidance

Check the Home Assistant configuration directory for any residual SSH private key files, particularly in custom_components/blueprint_studio/backend/. Look for files with names like id_rsa or similar that may have been created during terminal SSH key authentication. Use commands like 'find /path/to/config -name "id_rsa*"' to search for such files.

Impact Analysis

If you use Blueprint Studio versions before 2.5.2, an attacker with access to your Home Assistant configuration directory could steal the SSH private key. This could allow unauthorized access to systems or services that rely on that key for authentication, potentially leading to data breaches or further compromise of connected systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. If private keys are compromised, it may result in data breaches that require reporting under these regulations, potentially leading to fines or penalties for non-compliance.

Mitigation Strategies

Upgrade Blueprint Studio to version 2.5.2 or later to address the issue. Review the Home Assistant configuration directory for any residual SSH private keys and remove them immediately. Ensure restrictive file permissions are applied to sensitive files in the configuration directory.

Hi! I’m here to help you understand CVE-2026-53456. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70