Server‑Side Request Forgery (CVE‑2026‑91131) in Home Assistant Green Enables Unauthenticated Network‑Adjacency Exploits
What It Is — Home Assistant Green (the hardware‑optimized edition of the open‑source Home Assistant platform) contains a server‑side request forgery (SSRF) flaw in its aiohttp_client module (CVE‑2026‑91131). The defect arises from the client automatically following HTTP redirects without proper validation of the target URL. An attacker on the same local network can trigger arbitrary HTTP requests from the Home Assistant device, potentially chaining the SSRF with other vulnerabilities to achieve code execution as root. The vulnerability is rated CVSS 5.4 (Medium) and requires no authentication. Home Assistant has published a security advisory and released a patched version.
Affected Products — Home Assistant Green (all firmware versions prior to the November 2026 security update).
Why It Matters for Trust & Control Assurance — The issue underscores the importance of robust input‑validation and network‑segmentation controls, a single control objective that maps to many frameworks (e.g., NIST CSF 2.0).
Recommended Actions —
- Deploy the Home Assistant Green update that disables insecure redirects.
- Review and harden any custom integrations that perform outbound HTTP calls.
- Enforce network‑level segmentation to isolate Home Assistant devices from untrusted LAN segments.
- Capture evidence of the patch and the updated configuration in your control‑mapping repository.
Source: Zero Day Initiative advisory