CVE-2026-72581 Overview
CVE-2026-72581 is a server-side request forgery (SSRF) vulnerability in the duhow/xiaoai-patch project through commit fb07049. The flaw resides in the /auth endpoint of api/main.py, which accepts a user-supplied url POST parameter and redirects to it without validation. Remote attackers can coerce the affected Xiaomi smart speaker into issuing HTTP requests to arbitrary internal or external destinations. This enables internal network reconnaissance and unauthorized access to services normally isolated from the public internet. The vulnerability is tracked under CWE-918 (Server-Side Request Forgery).
Critical Impact
Unauthenticated remote attackers can pivot through the smart speaker to reach internal Home Assistant instances and other services on the private network.
Affected Products
- duhow/xiaoai-patch project through commit fb07049
- Xiaomi smart speakers running the affected patch firmware
- Home Assistant integrations reachable via the vulnerable /auth endpoint
Discovery Timeline
- 2026-08-10 - CVE-2026-72581 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-72581
Vulnerability Analysis
The vulnerability exists in the /auth endpoint defined in api/main.py of the duhow/xiaoai-patch project. The endpoint accepts a url value from the POST request body and issues an HTTP redirect toward that destination. The code path assumes the parameter points to a trusted Home Assistant instance but performs no allowlist check, hostname validation, or scheme restriction. An attacker can substitute any URL, including addresses on RFC1918 networks, loopback interfaces, or cloud metadata endpoints. Because the smart speaker sits inside the victim's home or corporate network, this turns the device into a reflection point for internal reconnaissance and service abuse.
Root Cause
The root cause is missing destination validation on user-controlled input. The /auth handler treats the url POST parameter as a trusted redirect target. No parsing of the URL scheme, host, or resolved IP address occurs before the request is issued. This pattern maps directly to CWE-918, where server-side components fetch remote resources on behalf of a client without restricting the target.
Attack Vector
Exploitation requires only network access to the exposed API and no authentication or user interaction. An attacker sends a POST request to /auth with a crafted url parameter pointing at an internal host, such as http://192.168.1.1/admin or http://127.0.0.1:8123. The speaker's API layer then contacts the specified endpoint, exposing responses, banner information, and service availability to the attacker. See the Xiaoai API source code for the vulnerable handler.
Detection Methods for CVE-2026-72581
Indicators of Compromise
- Unexpected outbound HTTP requests from Xiaomi smart speakers to RFC1918 addresses, loopback, or cloud metadata endpoints such as 169.254.169.254.
- POST requests to the /auth endpoint containing url parameter values that resolve to internal hosts.
- Access log entries on internal services showing the smart speaker's IP as the client for previously unseen resource paths.
Detection Strategies
- Inspect HTTP proxy and firewall logs for connections originating from the speaker that target internal-only ports or administrative interfaces.
- Alert on POST requests to /auth where the url parameter contains private IP ranges, localhost, or non-Home Assistant hostnames.
- Correlate speaker traffic patterns against a baseline of expected Home Assistant destinations to surface deviations.
Monitoring Recommendations
- Enable verbose logging on the xiaoai-patch API and forward records to a centralized log platform for retention and analysis.
- Monitor DNS queries from IoT VLANs for lookups of internal hostnames that the speaker should never resolve.
- Track sudden increases in outbound request volume from the speaker, which can indicate scripted internal scanning.
How to Mitigate CVE-2026-72581
Immediate Actions Required
- Restrict network access to the /auth endpoint using host firewalls or network ACLs so only trusted management hosts can reach it.
- Place Xiaomi smart speakers on an isolated VLAN with egress rules that block traffic to internal management subnets and cloud metadata addresses.
- Audit the duhow/xiaoai-patch deployment for the vulnerable commit fb07049 and pin the project to a validated revision.
Patch Information
At the time of publication, no fixed release is referenced in the NVD entry. Monitor the duhow/xiaoai-patch GitHub repository for commits that add URL validation to the /auth handler. Any remediation should enforce an allowlist of permitted Home Assistant hostnames, reject non-HTTP(S) schemes, and resolve destinations to verify they are not private, loopback, or link-local addresses before initiating the request.
Workarounds
- Apply a local patch that validates the url parameter against a fixed allowlist of Home Assistant endpoints before redirecting.
- Front the API with a reverse proxy that rewrites or drops requests whose url parameter does not match approved destinations.
- Disable the /auth endpoint entirely if the Home Assistant redirect feature is not required in the deployment.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
