CVE-2026-53454: Blueprint Studio Information Disclosure

CVE-2026-53454 Overview

CVE-2026-53454 affects Blueprint Studio, a VS Code-like file editor for Home Assistant configuration files. Versions prior to 2.5.2 configure Git's credential.helper store when saving Git credentials. This setting causes Git to persist usernames and access tokens in plaintext in the .git-credentials file belonging to the user running Home Assistant. Any user or process with access to the same filesystem context can read those tokens. The persistent helper configuration also affects later Git operations beyond the immediate Blueprint Studio action. The issue is fixed in version 2.5.2 and is classified under [CWE-522: Insufficiently Protected Credentials].

Critical Impact
Git usernames and access tokens are written to disk in plaintext, exposing repository credentials to any local user or process with filesystem access.

Affected Products

Blueprint Studio versions prior to 2.5.2
Home Assistant deployments with Blueprint Studio integration installed
Any Git repositories accessed through the vulnerable Blueprint Studio credential flow

Discovery Timeline

2026-08-18 - CVE-2026-53454 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-53454

Vulnerability Analysis

Blueprint Studio invokes Git's credential storage subsystem to persist authentication material for remote repositories. Instead of scoping credentials to an in-memory helper or an encrypted store, the integration configures credential.helper store. Git then writes credentials to ~/.git-credentials in cleartext, formatted as URLs containing the username and personal access token.

The root exposure is twofold. First, the token file inherits the filesystem permissions of the Home Assistant runtime user, allowing lateral read access by any co-resident process or user with equivalent context. Second, the helper configuration remains active across subsequent Git operations, so tokens continue to be written and refreshed even for actions unrelated to the original Blueprint Studio save.

Root Cause

The root cause is unsafe credential handling logic in the Git manager backend. Blueprint Studio selected the store helper rather than a memory-only helper such as cache, or an OS-level secure store. Credentials that should have remained inside Home Assistant's intended storage escaped to a world-readable-by-owner file outside application boundaries.

Attack Vector

Exploitation requires local filesystem access under the same user context as Home Assistant, or an application-level flaw that reads arbitrary files. Once .git-credentials is read, the attacker recovers valid tokens and can authenticate to the referenced Git remote as the legitimate user. Because tokens frequently carry repo scope, this can lead to source code theft, supply chain tampering, or CI/CD pipeline abuse.

python

# Patch excerpt from custom_components/blueprint_studio/backend/api.py
# Blueprint Studio is registered as an admin-only panel and exposes config files,
# git operations, SFTP, terminal helpers, and HA service calls. Keep the backend
# at the same privilege level as the UI instead of trying to maintain a denylist.
_ADMIN_ONLY_ACTIONS = frozenset({
    "call_service",
    "delete",
    "delete_multi",
    "global_replace",
    "git_force_push",
    "git_hard_reset",
    "git_delete_repo",
    "git_delete_remote_branch",
    "render_template",
    "restart_home_assistant",
})

Source: GitHub Commit 943aed0

Detection Methods for CVE-2026-53454

Indicators of Compromise

Presence of a .git-credentials file in the home directory of the Home Assistant runtime user containing plaintext tokens.
Git configuration entries showing credential.helper=store applied globally or to Home Assistant configuration repositories.
Unexpected Git authentication events against remote repositories originating from the Home Assistant host.

Detection Strategies

Audit filesystems for .git-credentials artifacts and inspect file ownership, permissions, and contents.
Enumerate Git configuration via git config --list --show-origin on hosts running Blueprint Studio and flag credential.helper=store.
Correlate token usage against known good Blueprint Studio activity windows to identify anomalous reuse.

Monitoring Recommendations

Monitor read access to .git-credentials using filesystem auditing such as auditd or equivalent endpoint telemetry.
Alert on process execution of git config credential.helper store under Home Assistant service accounts.
Rotate and monitor personal access tokens through the Git hosting provider's audit log for unexpected sources.

How to Mitigate CVE-2026-53454

Immediate Actions Required

Upgrade Blueprint Studio to version 2.5.2 or later, which removes the insecure credential helper configuration.
Revoke any Git personal access tokens or passwords previously saved through Blueprint Studio and issue replacements with minimal scope.
Delete residual .git-credentials files and unset any lingering credential.helper=store entries in global and repository-level Git configurations.

Patch Information

The fix is delivered in Blueprint Studio 2.5.2. See the GitHub Release v2.5.2, the GitHub Security Advisory GHSA-pgxq-h2pc-gqq8, and the corresponding GitHub Commit 943aed0 for the patch that hardens the API surface and secures Git credential handling.

Workarounds

If immediate upgrade is not possible, avoid saving Git credentials through Blueprint Studio and use SSH keys or short-lived tokens instead.
Restrict filesystem access to the Home Assistant user directory using stricter permissions and mandatory access controls.
Configure a secure Git credential helper such as cache with a short timeout, or an OS keyring integration, in place of store.

bash

# Remove any persisted plaintext credentials and insecure helper configuration
rm -f ~/.git-credentials
git config --global --unset credential.helper
# Optional: switch to an in-memory helper with a short lifetime
git config --global credential.helper 'cache --timeout=300'