CVE-2026-66061 home-assistant CVE debrief

Who should care

Home Assistant users and administrators, iOS device administrators, security teams responsible for monitoring and securing automation systems, and operators managing affected deployments should assess exposure and prioritize remediation. They should also verify and apply the fixed version, restrict access, and monitor for suspicious activity.

Why it matters

CVE-2026-66061 allows untrusted apps to execute Home Assistant automations silently. Defenders should verify and apply the fixed version, restrict access, and monitor for suspicious activity. Home Assistant users and administrators, iOS device administrators, and security teams should assess exposure and prioritize remediation.

• Untrusted local callers can execute automations without user interaction
• Silent automation execution can lead to unintended consequences
• Verification of affected versions and remediation is necessary
• Exposure requires verification from official sources

Technical summary

The iOS Companion app for Home Assistant prior to version 2026.5.0 does not validate the calling app or prompt the user when treating tag links delivered through OS-level routing mechanisms like universal links as if they were physically scanned. This allows any untrusted app on the device to forward an arbitrary tag to Home Assistant, causing it to execute the associated automation silently and without user interaction.

Defensive priority

High

Recommended defensive actions

• Verify and apply the fixed version 2026.5.0 of Home Assistant
• Restrict access to the iOS Companion app to trusted sources
• Monitor for suspicious automation execution
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The iOS Companion app for Home Assistant treats tag links delivered through OS-level routing mechanisms like universal links as if they were physically scanned, without validating the calling app or prompting the user. This issue allows any untrusted app on the device to forward an arbitrary tag to Home Assistant, causing it to execute the associated automation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.