CVE-2026-91129: Home Assistant IPP Integration SSRF Vulnerability

CVE-2026-91129 Overview

Home Assistant, an open source home automation platform, contains a Server-Side Request Forgery (SSRF) vulnerability in its Internet Printing Protocol (IPP) integration prior to version 2026.2.3. The IPP config flow at homeassistant/components/ipp/config_flow.py automatically processes unauthenticated _ipp._tcp.local mDNS announcements. The async_step_zeroconf handler passes attacker-controlled host, port, and base_path values to validate_input for printer metadata retrieval. Because the shared HTTP client follows attacker-controlled cross-origin redirects without blocking loopback destinations, an adjacent-network attacker can pivot requests to 127.0.0.1 or other internal services. The flaw is tracked as [CWE-918].

Critical Impact
A local-network attacker can coerce the Home Assistant instance to issue HTTP requests to internal services without user interaction or prior IPP configuration.

Affected Products

Home Assistant Core versions prior to 2026.2.3
IPP integration (homeassistant/components/ipp)
Shared aiohttp client helper (homeassistant/helpers/aiohttp_client.py)

Discovery Timeline

2026-09-22 - CVE-2026-91129 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-91129

Vulnerability Analysis

The vulnerability is a Server-Side Request Forgery in Home Assistant's IPP integration. Home Assistant listens for mDNS service announcements on the local network to auto-discover printers. When a device advertises _ipp._tcp.local, the config flow immediately queries the announced endpoint to retrieve printer metadata. No user confirmation is required before the outbound HTTP request is issued.

An attacker on the same broadcast domain can craft a malicious mDNS announcement pointing at any host, port, and URL path. The shared aiohttp client then follows HTTP redirects returned by that endpoint. Because redirect targets are not validated against loopback or private-network address ranges, a remote endpoint can redirect the request to http://127.0.0.1:<port>/<path>, reaching internal services bound only to the loopback interface.

Root Cause

Two distinct weaknesses combine to enable the attack. First, async_step_zeroconf treats zero-configuration announcements as trusted input and forwards attacker-controlled connection parameters to validate_input. Second, the shared HTTP client in aiohttp_client.py follows cross-origin redirects unconditionally, with no allowlist or block on loopback and RFC 1918 destinations.

Attack Vector

Exploitation requires adjacent-network access. The attacker broadcasts a spoofed _ipp._tcp.local mDNS record advertising a controlled host. Home Assistant queries that host, which returns an HTTP 3xx redirect to an internal target such as http://127.0.0.1:8123/. The redirect is followed automatically, causing Home Assistant to interact with the internal service on behalf of the attacker.

python

# Security patch: homeassistant/helpers/aiohttp_client.py
# Block redirects to localhost (PR #162941)
from __future__ import annotations

import asyncio
from collections.abc import Awaitable, Callable, Sequence
from contextlib import suppress
from functools import lru_cache
from ipaddress import ip_address
import socket
from ssl import SSLContext
import sys
from types import MappingProxyType
from typing import TYPE_CHECKING, Any, Self

import aiohttp
from aiohttp import ClientMiddlewareType, hdrs, web
from aiohttp.hdrs import CONTENT_TYPE, USER_AGENT
from aiohttp.web_exceptions import HTTPBadGateway, HTTPGatewayTimeout
from aiohttp_asyncmdnsresolver.api import AsyncDualMDNSResolver
from yarl import URL

from homeassistant import config_entries
from homeassistant.components import zeroconf

Source: GitHub Commit 0f3c7ca. The patch introduces ip_address parsing and a client middleware that inspects redirect Location headers and rejects targets resolving to loopback addresses.

Detection Methods for CVE-2026-91129

Indicators of Compromise

Unexpected _ipp._tcp.local mDNS announcements from unknown MAC addresses on the local segment.
Outbound HTTP requests from the Home Assistant host to external IPs immediately followed by loopback connections to sensitive local ports.
Home Assistant log entries showing failed or successful IPP config flow attempts from unfamiliar hosts.

Detection Strategies

Monitor mDNS traffic for anomalous IPP service advertisements originating from non-printer devices.
Inspect Home Assistant home-assistant.log for homeassistant.components.ipp entries referencing unrecognized hosts, ports, or base paths.
Correlate outbound HTTP 3xx responses received by the Home Assistant process with subsequent connections to 127.0.0.1 or RFC 1918 addresses.

Monitoring Recommendations

Enable network traffic capture on the VLAN hosting Home Assistant to baseline expected mDNS announcers.
Alert on any new device advertising _ipp._tcp.local that has not previously been enrolled.
Track process-level connections from the Home Assistant Python process to loopback destinations that are not part of normal integration behavior.

How to Mitigate CVE-2026-91129

Immediate Actions Required

Upgrade Home Assistant Core to version 2026.2.3 or later immediately.
Audit existing IPP integrations for entries pointing at loopback or unexpected internal hosts and remove them.
Restrict the network segment on which Home Assistant listens for mDNS to trusted devices only.

Patch Information

The fix is delivered in Home Assistant Core release 2026.2.3. The patch modifies homeassistant/helpers/aiohttp_client.py to install a redirect-inspection middleware that blocks HTTP redirects targeting loopback addresses. See GitHub Release 2026.2.3, GitHub Pull Request #162941, and GitHub Security Advisory GHSA-4ghv-53cq-7wp3 for full details.

Workarounds

Disable the IPP integration until the upgrade is applied by removing it from configuration.yaml and any active config entries.
Isolate Home Assistant on a management VLAN that excludes untrusted devices capable of broadcasting mDNS.
Block egress from the Home Assistant host to arbitrary external HTTP endpoints via firewall policy, permitting only known-good integrations.

bash

# Upgrade Home Assistant Core container to the patched release
docker pull ghcr.io/home-assistant/home-assistant:2026.2.3
docker stop homeassistant
docker rm homeassistant
docker run -d --name homeassistant \
  --restart=unless-stopped \
  -v /PATH_TO_YOUR_CONFIG:/config \
  --network=host \
  ghcr.io/home-assistant/home-assistant:2026.2.3