CVE Explorer

CVE-2026-34205

Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (formerly add-ons) configured with host network mode expose unauthenticated endpoints bound to the internal Docker bridge interface to the local network. On Linux, this configuration does not restrict access to the app as intended, allowing any device on the same network to reach these endpoints without authentication. Home Assistant Supervisor 2026.03.02 addresses the issue.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:3d9e5b3086f64a3da650d43d5b52c12745773dbdfc51406112a228d5e3252ad1

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"product":"Home Assistant Supervisor","vendor":"home-assistant","versions":[{"status":"affected","version":"< 2026.03.2"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:430fce6c32fc49f0da90cca1f5146537b4c73983477e4214739a1353c7efdc2e · sha256:08c18accc4629002… · /containers/cna/affected/1

{"product":"Home Assistant Operating System","vendor":"home-assistant","versions":[{"status":"affected","version":"<= 17.1"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:430fce6c32fc49f0da90cca1f5146537b4c73983477e4214739a1353c7efdc2e · sha256:08c18accc4629002… · /containers/cna/affected/0

Affected products and versions

2 source assertions

{"product":"Home Assistant Supervisor","vendor":"home-assistant","versions":[{"status":"affected","version":"< 2026.03.2"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:430fce6c32fc49f0da90cca1f5146537b4c73983477e4214739a1353c7efdc2e · sha256:08c18accc4629002… · /containers/cna/affected/1

{"product":"Home Assistant Operating System","vendor":"home-assistant","versions":[{"status":"affected","version":"<= 17.1"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:430fce6c32fc49f0da90cca1f5146537b4c73983477e4214739a1353c7efdc2e · sha256:08c18accc4629002… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":9.7,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:430fce6c32fc49f0da90cca1f5146537b4c73983477e4214739a1353c7efdc2e · sha256:08c18accc4629002… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-923","description":"CWE-923: Improper Restriction of Communication Channel to Intended Endpoints","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:430fce6c32fc49f0da90cca1f5146537b4c73983477e4214739a1353c7efdc2e · sha256:08c18accc4629002… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion

{"name":"https://github.com/home-assistant/core/security/advisories/GHSA-gh5m-4m97-c95h","tags":["x_refsource_CONFIRM"],"url":"https://github.com/home-assistant/core/security/advisories/GHSA-gh5m-4m97-c95h"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:430fce6c32fc49f0da90cca1f5146537b4c73983477e4214739a1353c7efdc2e · sha256:08c18accc4629002… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer