CVE-2026-91129 home-assistant CVE debrief

Who should care

Defenders responsible for Home Assistant deployments in local network environments should assess exposure and prioritize upgrading to version 2026.2.3 or later. This includes reviewing compensating controls for exposed systems while remediation is scheduled and verified. Additionally, defenders should monitor for suspicious mDNS announcements and track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

CVE-2026-91129 is a medium-severity vulnerability affecting Home Assistant's IPP integration. Local network attackers could exploit this vulnerability to redirect requests to internal services without user interaction. Defenders responsible for Home Assistant deployments in local network environments should assess exposure and prioritize upgrading to version 2026.2.3 or later.

• Local network attackers could redirect requests to internal services
• Unauthenticated mDNS announcements could be used to exploit vulnerable deployments
• Verification of exposure and remediation is necessary for affected deployments

Technical summary

The IPP integration in Home Assistant automatically processed unauthenticated _ipp._tcp.local mDNS announcements, allowing a local-network attacker to redirect requests to internal services without user interaction. This vulnerability can be exploited by a local-network attacker to potentially gain unauthorized access to internal services. The vulnerability has a CVSS score of 5.4 and is considered medium-severity. The issue is fixed in version 2026.2.3. Defenders should prioritize verifying exposure in local network deployments and upgrading to version 2026.2.3 or later.

Defensive priority

Defenders should prioritize verifying exposure in local network deployments and upgrading to version 2026.2.3 or later.

Recommended defensive actions

• Verify exposure in local network deployments
• Upgrade to version 2026.2.3 or later
• Monitor for suspicious mDNS announcements
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability affects Home Assistant versions prior to 2026.2.3. The IPP integration's automatic processing of unauthenticated mDNS announcements allows a local-network attacker to redirect requests to internal services without user interaction. The CVE record was published on 2026-09-22T19:16:56.433Z and has not been modified since then. The NVD entry provides additional information on the vulnerability

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.