Local Network Security Flaw in Home Assistant IPP Integration

CVE-2026-91129

What is CVE-2026-91129?

Home Assistant, a local control-focused open-source home automation software, has a vulnerability affecting its IPP integration prior to version 2026.2.3. The vulnerability arises from the automatic processing of unauthenticated mDNS announcements, allowing malicious actors on the same local network to manipulate requests. They could pass attacker-controlled values to the system, leading to potential redirection of sensitive internal service requests to localhost or other internal resources without any user interaction. This critical issue has been addressed in the latest release, ensuring improved security against local network threats.

References