{"answers":{"affected":"2 open source packages ship an affected version, including ha-mcp.","exploited":"There is no known exploitation of GHSA-q855-8rh5-jfgq in the wild and no public exploit code.","fix":"Upgrade ha-mcp to 7.10.0 or later.","what":"GHSA-q855-8rh5-jfgq is a missing authorization vulnerability in ha-mcp, published on 7 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-q855-8rh5-jfgq and fix it if it is affected.\n\nWhat it is: GHSA-q855-8rh5-jfgq is a missing authorization vulnerability in ha-mcp, published on 7 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-q855-8rh5-jfgq in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- ha-mcp (PyPI): affected all versions; fixed in 7.10.0\n- ha-mcp (PyPI): affected all versions; fixed in 7.10.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-q855-8rh5-jfgq/ (Markdown: https://insights.sbomify.com/GHSA-q855-8rh5-jfgq/index.md)","id":"GHSA-q855-8rh5-jfgq","markdown":"https://insights.sbomify.com/GHSA-q855-8rh5-jfgq/index.md","name":"GHSA-q855-8rh5-jfgq","record":{"aliases":[],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["data_modify","security_bypass"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Home Assistant add-on","requires_auth":"none","summary":"Unauthenticated attackers on the local network can modify Home Assistant MCP add-on settings, toggle features, and manage backups due to missing authentication on root routes.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n\nIn add-on mode, the ha-mcp settings UI routes are mounted both under the MCP secret path **and** at the bare root of the published port (`:9583`), so Home Assistant ingress can serve the \"Open Web UI\" button. The root-mounted routes perform no authentication — no secret, no `Origin` check, no CSRF token — so any client that can reach `:9583` without the MCP secret can invoke them.\n\n### Affected configurations\n\nHome Assistant **add-on** installations (`host_network: true` with port `9583` published), v7.6.0 and earlier. Docker and standalone installs are **not** affected — there the settings routes are mounted only under the secret path.\n\nRoot-mounted routes in affected versions: tool visibility (`/api/settings/tools` GET/POST), feature flags (`/api/settings/features` GET/POST), the auto-backup suite (`/api/settings/backups…` incl. restore/delete, and `/api/settings/backup-config`), add-on restart (`/api/settings/restart`), and — when the opt-in Tool Security Policies feature is enabled — the approval-policy API (`/api/policy/config` GET/PUT, `/api/policy/approve`, `/api/policy/deny`, …).\n\n### Impact\n\nWithout authentication, a caller that reaches `:9583` — a peer on the local network, a reverse proxy/tunnel that forwards the bare root path (e.g. a whole-host Cloudflared config), or a CSRF `POST` from a page open in a LAN browser — can read or change which MCP tools are exposed, toggle feature flags, list/view/restore/delete backups, restart the add-on, and (with Tool Security Policies enabled) read and rewrite the approval policy, disabling the human-approval gate on gated tools.\n\nThere is **no** access to Home Assistant data, entities, or credentials, and no code execution. All effects are confined to the add-on's own configuration and lifecycle and are recoverable. The primary (same-LAN) vector is within the add-on's documented trusted-network model; remote reachability requires the operator to have reverse-proxied the bare port.\n\n### Proof of concept\n\nWith the add-on running and reachable on `:9583`, from any host that can reach the port without the secret:\n\n```\nGET  /api/settings/tools                 -\u003e 200   (read tool config, no auth)\nPOST /api/settings/tools  {\"states\":{}}  -\u003e 200   (rewrite tool config, no auth / no CSRF token)\nPOST /api/settings/restart               -\u003e 200   (restart the add-on)\n```\n\nThe MCP endpoint itself remains correctly protected by the secret path.\n\n### Patch\n\nFixed in PR homeassistant-ai/ha-mcp#1508 (merged to `master`): the root-mounted add-on routes are restricted to Home Assistant ingress, which always originates from the Supervisor (`172.30.32.2`); every other caller receives `403`. Direct and remote access continue to use the settings UI under the MCP secret path (`…/\u003csecret\u003e/settings`), so the \"Open Web UI\" button, Cloudflared, and the Webhook Proxy add-on are unaffected.\n\nThe fix will ship in the next stable add-on release. If you'd rather have it now, it is already on the dev channel (add-on dev build ` 7.6.0.dev393` or later) — optional; there's no need to switch channels just for this, it is a fairly low risk surface and only exposes the web UI for addon mode only.\n\n### Severity\n\n`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L` = 6.4 (Moderate). Confidentiality impact is None — tool config and backups are not secrets or credentials; integrity and availability impacts are Low — configuration changes and an add-on restart are recoverable.\n\n### Credit\n\nReported by @bharat.","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path","id":"GHSA-q855-8rh5-jfgq","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":["7.10.0"],"introduced":["0"],"last_affected":[],"package":"ha-mcp","purl":null,"source":"GHSA-q855-8rh5-jfgq"},{"ecosystem":"PyPI","fixed":["7.10.0"],"introduced":["0"],"last_affected":[],"package":"ha-mcp","purl":"pkg:pypi/ha-mcp","source":"GHSA-q855-8rh5-jfgq"}],"products":null,"published":"2026-07-07","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Unauthenticated attackers on the local network can modify Home Assistant MCP add-on settings, toggle features, and manage backups due to missing authentication on root routes.","url":"https://insights.sbomify.com/GHSA-q855-8rh5-jfgq/"}