Search/CVE-2026-34205
● CVE — Critical

CVE-2026-34205

DiscoveredMar 27, 2026UpdatedOct 26, 2026

Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (formerly add-ons) configured with host network mode expose unauthenticated endpoints bound to the internal Docker bridge interface to the local network. On Linux, this configuration does not restrict access to the app as intended, allowing any device on the same network to reach these endpoints without authentication. Home Assistant Supervisor 2026.03.02 addresses the issue.

CVSS v3.1
9.6 CRITICAL
EPSS
0.27%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Oct 26, 2026
▲ 0.01pp
0.26% → 0.27% over 4 tracked changes
CVSS v3.1 Detail
Attack VectorADJACENT
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Connections
1 relationships
Timeline
disclosure → media coverage
Mar 27, 2026
Disclosure — published as a CVE record. · last revised by NVD Oct 26, 2026