Home Assistant Green Vulnerable to SSRF via aiohttp_client
A server-side request forgery (SSRF) vulnerability in Home Assistant Green's aiohttp_client component allows network-adjacent attackers to make arbitrary server-side requests without authentication.
A critical server-side request forgery (SSRF) vulnerability has been identified in Home Assistant Green, specifically within its aiohttp_client component. This flaw, tracked as CVE-2026-91131, permits network-adjacent attackers to initiate arbitrary requests from the affected server. Crucially, the exploitation of this vulnerability does not require any form of authentication, significantly lowering the barrier for potential attackers.
The vulnerability stems from how the aiohttp_client module handles HTTP redirects. By manipulating these redirects, an attacker can coerce the Home Assistant Green instance into making requests to unintended internal or external resources. While the SSRF itself allows for arbitrary server-side requests, it can be chained with other potential vulnerabilities to achieve remote code execution in the context of the root user, posing a severe security risk.
Zero Day Initiative (ZDI), which disclosed the vulnerability, assigned it a CVSS score of 5.4, categorizing it as medium severity. However, the potential for chaining with other exploits to achieve root-level code execution elevates the practical risk for users. The vulnerability was discovered by Team Neodyme and reported to the vendor on November 5, 2025.
Home Assistant has responded to this vulnerability by issuing a security update. Users are strongly advised to update their Home Assistant Green installations to the latest version to mitigate this risk. Further details regarding the fix and affected versions can be found in the official security advisory released by Home Assistant.
The disclosure timeline indicates a coordinated public release on November 6, 2026, following the initial vendor notification over a year prior. This extended period highlights the typical process of vulnerability discovery, vendor patching, and coordinated disclosure to ensure users have adequate time to apply updates.
This incident underscores the importance of securing Internet of Things (IoT) devices, especially those that manage home automation and potentially sensitive network traffic. Home Assistant Green, being a dedicated hardware device for running Home Assistant, is a prime target for attackers seeking to gain a foothold in a home network.
Users should ensure their Home Assistant Green devices are running the latest software version. Regular security audits and network segmentation can also help limit the potential impact of such vulnerabilities. The vendor's prompt release of a patch is a positive step, but vigilance in applying updates remains paramount for all connected devices.
This new advisory details a local privilege escalation vulnerability (CVE-2026-91131) affecting Home Assistant Green, distinct from the previously reported SSRF flaw. Attackers with low-privileged code execution within a container can exploit this flaw to gain higher privileges by leveraging the plaintext storage of credentials. The Zero Day Initiative assigned this vulnerability a CVSS score of 8.8 and has been patched by Home Assistant.