CVE-2026-54317 Overview
CVE-2026-54317 affects Home Assistant, an open source home automation platform focused on local control and privacy. The Konnected integration registers an HTTP endpoint, KonnectedView, that is marked with requires_auth = False. A code comment states authentication is enforced through a configured access token. That enforcement is incomplete. Write requests (POST and PUT) validate the Authorization: Bearer <token> header using hmac.compare_digest. Read requests (GET) reach a separate get() method that performs no authentication check. Unauthenticated clients on the adjacent network can read sensor state exposed by the integration. The issue is fixed in Home Assistant 2026.6.0.
Critical Impact
An unauthenticated adjacent attacker can issue GET requests to the Konnected KonnectedView endpoint and retrieve sensor data without supplying the configured access token.
Affected Products
- Home Assistant Core versions prior to 2026.6.0
- Konnected integration shipped in homeassistant/components/konnected/__init__.py
- Deployments exposing the Home Assistant HTTP API on a local or adjacent network
Discovery Timeline
- 2026-06-23 - CVE-2026-54317 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2026-54317
Vulnerability Analysis
The Konnected integration in Home Assistant registers an HTTP view, KonnectedView, to support sensor updates from Konnected devices. The class sets requires_auth = False, opting the endpoint out of Home Assistant's standard authentication layer. The developers intended to compensate by validating an integration-specific access token inside the request handlers. That validation exists in update_sensor(), which serves POST and PUT requests and compares the bearer token using hmac.compare_digest. The companion get() handler omits the same check. Any client able to reach the endpoint can issue GET requests and read the data the view exposes, which represents an information disclosure flaw classified as [CWE-200]. The flaw stems from inconsistent application of an authentication control across HTTP methods on the same view, not a cryptographic or memory safety defect.
Root Cause
The root cause is missing authentication on a sensitive method handler. By setting requires_auth = False at the view level and only re-implementing token validation in the write path, the developers left the read path entirely unauthenticated. The framework treats the comment about access tokens as documentation, not enforcement.
Attack Vector
Exploitation requires network reachability to the Home Assistant HTTP API, typically on the local network where Home Assistant is deployed. The attacker sends a crafted GET request to the Konnected view route. No credentials, tokens, or user interaction are required. The response discloses sensor state managed by the Konnected integration.
No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-x84v-g949-293w for the maintainer's technical description.
Detection Methods for CVE-2026-54317
Indicators of Compromise
- Unauthenticated GET requests to Konnected integration routes registered by KonnectedView in Home Assistant access logs
- Requests to Konnected endpoints lacking an Authorization: Bearer header that still return HTTP 200 responses
- Repeated polling of Konnected sensor endpoints from non-Konnected device IP addresses on the local network
Detection Strategies
- Enable verbose HTTP access logging in Home Assistant and alert on GET requests to Konnected paths originating from hosts other than the configured Konnected hardware
- Inspect reverse proxy or firewall logs for anonymous GET traffic to the Home Assistant API on the Konnected route
- Audit the installed Home Assistant Core version and confirm whether the Konnected integration is enabled
Monitoring Recommendations
- Centralize Home Assistant logs in a SIEM or data lake and build a rule for unauthenticated reads against the Konnected endpoint
- Track Home Assistant Core version drift across managed deployments to identify hosts still running releases earlier than 2026.6.0
- Monitor adjacent-network traffic to TCP port 8123 (default Home Assistant port) for unexpected client IPs
How to Mitigate CVE-2026-54317
Immediate Actions Required
- Upgrade Home Assistant Core to 2026.6.0 or later, where the get() handler enforces the same token check as update_sensor()
- Restrict network access to the Home Assistant HTTP API so that only trusted local hosts can reach it
- Audit Konnected integration configuration and rotate the access token if unauthorized reads are suspected
Patch Information
The upstream fix is delivered in Home Assistant Core 2026.6.0. The maintainers added bearer token validation to the GET handler in the Konnected view. Patch details are documented in the GitHub Security Advisory GHSA-x84v-g949-293w.
Workarounds
- Disable the Konnected integration until Home Assistant Core is upgraded to 2026.6.0 or later
- Place Home Assistant behind a reverse proxy that enforces authentication or IP allow-listing on the Konnected endpoint
- Segment Konnected devices and the Home Assistant host onto a dedicated VLAN with strict ingress controls
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
