CVE-2026-72581
Received Received - Intake

SSRF Vulnerability in Xiaoai Patch Xiaomi Smart Speaker

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to redirect to a Home Assistant instance without validating the destination URL, enabling internal network scanning and access to internal services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-72581
EUVD
EUVD-2026-55225

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
duhow xiaoai-patch *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a server-side request forgery (SSRF) vulnerability in the duhow/xiaoai-patch project. It allows a remote attacker to trick a Xiaomi smart speaker into making HTTP requests to arbitrary internal or external URLs. The vulnerability exists in the /auth endpoint of api/main.py, which uses a user-supplied URL parameter to redirect to a Home Assistant instance without validating the destination. This enables attackers to scan internal networks and access internal services.

Detection Guidance

Monitor network traffic for unexpected HTTP requests originating from the Xiaomi smart speaker, especially to internal or external URLs. Check logs in Home Assistant or related services for unusual connections to the /auth endpoint with user-supplied URL parameters.

Impact Analysis

If you use the duhow/xiaoai-patch on your Xiaomi smart speaker, an attacker could exploit this to make your device send requests to internal network services or external URLs. This could lead to unauthorized access to sensitive services, internal network scanning, or potential data exfiltration through your device.

Compliance Impact

This vulnerability could lead to unauthorized network access and data exposure, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized access to internal services could result in data breaches, triggering regulatory penalties and legal consequences.

Mitigation Strategies

Disable or restrict access to the /auth endpoint in api/main.py. Validate and sanitize all user-supplied URL parameters to prevent SSRF attacks. Update to a patched version if available or remove the vulnerable component until a fix is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72581. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart