CVE-2026-34205: Home Assistant Auth Bypass Vulnerability

CVE-2026-34205 Overview

Home Assistant is open source home automation software that prioritizes local control and privacy. A critical vulnerability has been identified in Home Assistant apps (formerly add-ons) configured with host network mode, which expose unauthenticated endpoints bound to the internal Docker bridge interface to the local network. On Linux systems, this configuration does not restrict access to the app as intended, allowing any device on the same network to reach these endpoints without authentication.

Critical Impact
Any device on the local network can access unauthenticated Home Assistant app endpoints, potentially allowing unauthorized control of smart home devices and access to sensitive home automation data.

Affected Products

Home Assistant Supervisor versions prior to 2026.03.02
Home Assistant apps configured with host network mode on Linux systems
Docker-based Home Assistant deployments with bridge network configurations

Discovery Timeline

2026-03-27 - CVE CVE-2026-34205 published to NVD
2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-34205

Vulnerability Analysis

This vulnerability falls under CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints), which represents a fundamental flaw in how network access controls are implemented within the Docker containerization layer. The issue arises from a misconfiguration in how Home Assistant Supervisor handles network isolation for apps running in host network mode.

When Home Assistant apps are configured with host network mode, the intended behavior is to bind unauthenticated endpoints only to the internal Docker bridge interface (docker0), restricting access to inter-container communication. However, on Linux systems, the actual implementation fails to enforce this restriction properly, causing these endpoints to become accessible from the broader local network.

This represents a significant authentication bypass vulnerability that affects the core security model of Home Assistant's add-on architecture. The adjacent network attack vector means an attacker needs to be on the same local network segment, but once there, no user interaction or authentication is required to exploit the vulnerability.

Root Cause

The root cause stems from improper network binding configuration in the Docker bridge interface implementation within Home Assistant Supervisor. The Linux-specific behavior of Docker networking causes endpoints intended for internal bridge communication to be exposed on all network interfaces, bypassing the intended access restrictions. This is a configuration oversight rather than a code logic error, where the assumption that binding to the Docker bridge would limit network exposure does not hold true in Linux Docker environments.

Attack Vector

The attack vector is adjacent network-based, requiring the attacker to have access to the same local network as the Home Assistant installation. Once on the network, an attacker can:

Scan the local network for Home Assistant instances
Identify exposed unauthenticated endpoints on the Docker bridge interface
Directly interact with these endpoints without any authentication
Potentially gain control over connected smart home devices, access sensitive configuration data, or pivot to other systems on the network

The vulnerability requires no privileges and no user interaction, making it particularly dangerous in environments where the local network is accessible to untrusted devices or users.

Detection Methods for CVE-2026-34205

Indicators of Compromise

Unexpected network connections to Home Assistant app endpoints from devices outside the Docker network
Unusual API calls or commands to Home Assistant apps that bypass normal authentication flows
Network traffic analysis showing direct connections to Docker bridge interface ports from external local network addresses

Detection Strategies

Monitor network traffic for connections to Home Assistant endpoints originating from IP addresses outside expected Docker container ranges
Implement network segmentation monitoring to detect cross-boundary access attempts
Deploy intrusion detection rules to identify unauthenticated access patterns to Home Assistant services
Review Home Assistant Supervisor logs for anomalous app interactions without corresponding authenticated sessions

Monitoring Recommendations

Enable verbose logging for Home Assistant Supervisor and all installed apps
Implement network-level monitoring for traffic to and from the Docker bridge interface
Set up alerts for new devices connecting to Home Assistant endpoints
Regularly audit network configurations to ensure proper isolation of Docker containers

How to Mitigate CVE-2026-34205

Immediate Actions Required

Update Home Assistant Supervisor to version 2026.03.02 or later immediately
Review all installed Home Assistant apps for host network mode configuration
Implement network segmentation to isolate Home Assistant from untrusted network segments
Consider temporarily disabling apps using host network mode until the patch is applied

Patch Information

Home Assistant Supervisor version 2026.03.02 addresses this vulnerability by properly restricting endpoint binding to prevent unauthenticated access from the local network. Users should update through the standard Home Assistant update mechanism or by manually updating the Supervisor component.

For more details, refer to the GitHub Security Advisory.

Workarounds

Place Home Assistant on a dedicated VLAN or isolated network segment to limit exposure
Configure firewall rules to restrict access to Docker bridge interface ports from the local network
Disable host network mode for apps where this configuration is not strictly necessary
Implement additional network-level authentication for accessing Home Assistant services

bash

# Example firewall rule to restrict Docker bridge access (iptables)
# Adjust the IP ranges and ports according to your environment
iptables -A INPUT -i docker0 -s 192.168.0.0/16 -j DROP
iptables -A INPUT -i docker0 -s 172.16.0.0/12 ! -s 172.17.0.0/16 -j DROP