CVE-2026-66060 home-assistant CVE debrief

Who should care

Defenders responsible for Home Assistant installations, particularly those using the Companion app, should assess their exposure and verify their installations are updated to a secure version to prevent silent, unattended automation execution by untrusted local callers.

Why it matters

The vulnerability in Home Assistant allows untrusted local apps to execute automations without user interaction, posing a risk to Home Assistant installations. Defenders should verify their installations and ensure they are updated to a secure version.

• Untrusted local apps can execute arbitrary Home Assistant automations without user interaction
• Silent automation execution can occur without legitimate user action
• Automation execution can be triggered without physical tag scanning
• Verification of Home Assistant installation and app permissions is required

Technical summary

The Companion app in Home Assistant treats tag links delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user. This allows any untrusted app on the device to forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. The vulnerability allows untrusted local apps to execute automations without user interaction, posing a risk to Home Assistant installations. Defenders should verify their installations and ensure they are updated to a secure version.

Defensive priority

Defenders should prioritize verifying their Home Assistant installations and ensuring they are updated to a secure version, as the vulnerability allows for silent, unattended automation execution by untrusted local callers.

Recommended defensive actions

• Verify Home Assistant installation and update to version 2026.8.1 or later
• Review and restrict app permissions on devices with Home Assistant Companion app installed
• Monitor Home Assistant logs for suspicious automation activity
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.1 and HIGH severity. The issue is fixed in version 2026.8.1. This vulnerability allows untrusted local apps to execute automations without user interaction. Defenders should verify their installations and ensure they are updated to a secure version. The Companion app in Home Assistant treats tag links delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.