# GHSA-q855-8rh5-jfgq: ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path > Unauthenticated attackers on the local network can modify Home Assistant MCP add-on settings, toggle features, and manage backups due to missing authentication on root routes. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Local or same network only - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 7 Jul 2026 ## What is GHSA-q855-8rh5-jfgq? GHSA-q855-8rh5-jfgq is a missing authorization vulnerability in ha-mcp, published on 7 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim. ### Official description ### Summary In add-on mode, the ha-mcp settings UI routes are mounted both under the MCP secret path **and** at the bare root of the published port (`:9583`), so Home Assistant ingress can serve the "Open Web UI" button. The root-mounted routes perform no authentication — no secret, no `Origin` check, no CSRF token — so any client that can reach `:9583` without the MCP secret can invoke them. ### Affected configurations Home Assistant **add-on** installations (`host_network: true` with port `9583` published), v7.6.0 and earlier. Docker and standalone installs are **not** affected — there the settings routes are mounted only under the secret path. Root-mounted routes in affected versions: tool visibility (`/api/settings/tools` GET/POST), feature flags (`/api/settings/features` GET/POST), the auto-backup suite (`/api/settings/backups…` incl. restore/delete, and `/api/settings/backup-config`), add-on restart (`/api/settings/restart`), and — when the opt-in Tool Security Policies feature is enabled — the approval-policy API (`/api/policy/config` GET/PUT, `/api/policy/approve`, `/api/policy/deny`, …). ### Impact Without authentication, a caller that reaches `:9583` — a peer on the local network, a reverse proxy/tunnel that forwards the bare root path (e.g. a whole-host Cloudflared config), or a CSRF `POST` from a page open in a LAN browser — can read or change which MCP tools are exposed, toggle feature flags, list/view/restore/delete backups, restart the add-on, and (with Tool Security Policies enabled) read and rewrite the approval policy, disabling the human-approval gate on gated tools. There is **no** access to Home Assistant data, entities, or credentials, and no code execution. All effects are confined to the add-on's own configuration and lifecycle and are recoverable. The primary (same-LAN) vector is within the add-on's documented trusted-network model; remote reachability requires the operator to have reverse-proxied the bare port. ### Proof of concept With the add-on running and reachable on `:9583`, from any host that can reach the port without the secret: ``` GET /api/settings/tools -> 200 (read tool config, no auth) POST /api/settings/tools {"states":{}} -> 200 (rewrite tool config, no auth / no CSRF token) POST /api/settings/restart -> 200 (restart the add-on) ``` The MCP endpoint itself remains correctly protected by the secret path. ### Patch Fixed in PR homeassistant-ai/ha-mcp#1508 (merged to `master`): the root-mounted add-on routes are restricted to Home Assistant ingress, which always originates from the Supervisor (`172.30.32.2`); every other caller receives `403`. Direct and remote access continue to use the settings UI under the MCP secret path (`…//settings`), so the "Open Web UI" button, Cloudflared, and the Webhook Proxy add-on are unaffected. The fix will ship in the next stable add-on release. If you'd rather have it now, it is already on the dev channel (add-on dev build ` 7.6.0.dev393` or later) — optional; there's no need to switch channels just for this, it is a fairly low risk surface and only exposes the web UI for addon mode only. ### Severity `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L` = 6.4 (Moderate). Confidentiality impact is None — tool config and backups are not secrets or credentials; integrity and availability impacts are Low — configuration changes and an add-on restart are recoverable. ### Credit Reported by @bharat. ## Which versions are affected by GHSA-q855-8rh5-jfgq? 2 open source packages ship an affected version, including ha-mcp. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `ha-mcp` | PyPI | All versions | 7.10.0 | | `ha-mcp` | PyPI | All versions | 7.10.0 | ## How do I fix GHSA-q855-8rh5-jfgq? Upgrade ha-mcp to 7.10.0 or later. ## Is GHSA-q855-8rh5-jfgq being exploited? There is no known exploitation of GHSA-q855-8rh5-jfgq in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for GHSA-q855-8rh5-jfgq and fix it if it is affected. What it is: GHSA-q855-8rh5-jfgq is a missing authorization vulnerability in ha-mcp, published on 7 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim. Exploitation: There is no known exploitation of GHSA-q855-8rh5-jfgq in the wild and no public exploit code. Affected packages and fixed versions: - ha-mcp (PyPI): affected all versions; fixed in 7.10.0 - ha-mcp (PyPI): affected all versions; fixed in 7.10.0 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/GHSA-q855-8rh5-jfgq/ (Markdown: https://insights.sbomify.com/GHSA-q855-8rh5-jfgq/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/GHSA-q855-8rh5-jfgq --- From sbomify Insights: https://insights.sbomify.com/GHSA-q855-8rh5-jfgq/ Summaries are generated and may contain mistakes; the official description above is the record.