CVE-2026-91129
Received Received - Intake

SSRF via Unauthenticated IPP mDNS in Home Assistant

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated _ipp._tcp.local mDNS announcements in homeassistant/components/ipp/config_flow.py, where async_step_zeroconf passed attacker-controlled host, port, and base_path values to validate_input for printer metadata retrieval. Because the shared HTTP client followed attacker-controlled cross-origin redirects without blocking loopback targets, a local-network attacker could redirect the request to 127.0.0.1 or another internal service without user interaction or prior IPP configuration. This issue is fixed in version 2026.2.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-91129
EUVD
EUVD-2026-84804

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
home_assistant home_assistant to 2026.2.2 (exc)
home_assistant home_assistant 2026.2.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Home Assistant versions before 2026.2.3. It occurs in the IPP integration which automatically processes unauthenticated mDNS announcements for printers. Attackers on the local network can send crafted mDNS responses that trick Home Assistant into making HTTP requests to arbitrary hosts, including internal services like localhost. The vulnerability exists because the HTTP client follows redirects without blocking loopback targets.

Detection Guidance

To detect this vulnerability, monitor for unexpected mDNS _ipp._tcp.local announcements on your local network. Use tools like tcpdump to capture mDNS traffic: tcpdump -i any -nn port 5353. Check Home Assistant logs for automatic IPP integration processing or HTTP requests to localhost/127.0.0.1 originating from the IPP component.

Impact Analysis

An attacker on your local network could exploit this to access internal services running on your Home Assistant device or other machines on your network. They might retrieve sensitive data from internal services bound to localhost or other internal IPs without authentication. The impact is limited to confidentiality and integrity as the CVSS score indicates low severity for those aspects.

Mitigation Strategies

Upgrade Home Assistant to version 2026.2.3 or later immediately. Disable the IPP integration if not needed. Monitor network traffic for suspicious mDNS announcements or unexpected localhost requests. Ensure your Home Assistant instance is isolated from untrusted networks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91129. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart