CVE-2026-66060

Received Received - Intake

Unauthorized Automation Execution in Home Assistant Companion App

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue is fixed in version 2026.8.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-66060

EUVD

EUVD-2026-54654

Affected Vendors & Products

Vendor	Product	Version / Range
home_assistant	home_assistant	to 2026.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Home Assistant before version 2026.5.3 has a flaw where the Companion app accepts tag links (NFC or QR) from any untrusted app without verifying the source or user confirmation. This lets any local app silently trigger automations as if a legitimate user scanned an authorized tag.

Detection Guidance

Check the version of Home Assistant installed. If it is below 2026.5.3, the system is vulnerable. Look for unexpected automation triggers or logs indicating unauthorized tag link execution.

Impact Analysis

An attacker or malicious app on your device could silently activate Home Assistant automations without your knowledge or consent. This could lead to unauthorized actions like unlocking doors, disabling alarms, or changing smart home settings.

Compliance Impact

The vulnerability allows unauthorized local apps to trigger Home Assistant automations without user validation, potentially enabling unauthorized data access or processing. This could violate GDPR principles of lawful processing and user consent, and HIPAA requirements for access controls and audit trails if sensitive data is involved.

Mitigation Strategies

Update Home Assistant to version 2026.8.1 or later immediately. Disable NFC or QR tag automation if not essential. Review automation logs for suspicious activity.

Hi! I’m here to help you understand CVE-2026-66060. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70