CVE-2026-72581 duhow CVE debrief

Who should care

Organizations and individuals using Xiaomi smart speakers with the duhow/xiaoai-patch component should be aware of this vulnerability and take steps to mitigate it. This includes applying patches or updates provided by the vendor, restricting access to the /auth endpoint in api/main.py, implementing input validation and sanitization for user-supplied URLs, and monitoring for suspicious activity. Security teams and vulnerability management teams should prioritize patching and implement compensating controls to detect potential internal network scanning.

Technical summary

A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to redirect to a Home Assistant instance without validating the destination URL, enabling internal network scanning and access to internal services. This vulnerability has a high CVSS score of 8.6 and requires immediate attention from organizations using Xiaomi smart speakers with the duhow/xiaoai-patch component.

Defensive priority

Organizations using Xiaomi smart speakers with the duhow/xiaoai-patch component should prioritize patching to prevent potential internal network scanning and access to internal services.

Recommended defensive actions

• Apply patches or updates provided by the vendor to fix the SSRF vulnerability
• Restrict access to the /auth endpoint in api/main.py to prevent unauthorized use
• Implement input validation and sanitization for user-supplied URLs
• Monitor for suspicious activity and implement compensating controls to detect potential internal network scanning
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

Evidence is limited; primary official records indicate a server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The vulnerability was reported through a CVE record and NVD detail. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources