CVE-2026-34205 Home Assistant: Unauthenticated App (Add-on) Endpoints Exposed to Local Network via Host Network Mode
Attackers on the local network can access unauthenticated Home Assistant app endpoints when host network mode is enabled, bypassing intended access restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-34205?
CVE-2026-34205 is a critical missing authorization vulnerability in home-assistant Home Assistant Operating System, published on 27 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (formerly add-ons) configured with host network mode expose unauthenticated endpoints bound to the internal Docker bridge interface to the local network. On Linux, this configuration does not restrict access to the app as intended, allowing any device on the same network to reach these endpoints without authentication. Home Assistant Supervisor 2026.03.02 addresses the issue.
Weakness: CWE-923
Which versions are affected by CVE-2026-34205?
How do I fix CVE-2026-34205?
No fix has been published for CVE-2026-34205 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-34205 being exploited?
There is no known exploitation of CVE-2026-34205 in the wild and no public exploit code.