CVE-2026-54317
published 2026-06-23CVE-2026-54317: Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.6.0, the Konnected integration registers an…
PriorityP348high7.6CVSS 3.1
AVAACLPRNUINSUCHILAL
EPSS
0.19%
9.2th percentile
Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.6.0, the Konnected integration registers an HTTP endpoint, KonnectedView (homeassistant/components/konnected/__init__.py), that is marked as not requiring authentication (requires_auth = False). A comment next to that line says auth is instead handled "via the access token from configuration." That promise is only half true. Write requests (POST and PUT) are handled by update_sensor(), which does check the request's Authorization: Bearer header against the integration's stored access tokens (using hmac.compare_digest). Read requests (GET) are handled by a separate get() method that has no authentication check at all. This vulnerability is fixed in 2026.6.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| home-assistant | core | < 2026.6.0 | 2026.6.0 |
| home-assistant | home-assistant | < 2026.6.0 | 2026.6.0 |
CVSS provenance
nvdv3.17.6HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
ghsa4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
home-assistant core 2026.01/2026.5.3 HTTP Endpoint __init__.py update_sensor information disclosure (GHSA-x84v-g949-293w)
vuldb·2026-06-23·CVSS 7.6
CVE-2026-54317 [HIGH] home-assistant core 2026.01/2026.5.3 HTTP Endpoint __init__.py update_sensor information disclosure (GHSA-x84v-g949-293w)
A vulnerability was found in home-assistant core 2026.01/2026.5.3. It has been classified as problematic. The affected element is the function update_sensor of the file homeassistant/components/konnected/__init__.py of the component HTTP Endpoint. The manipulation leads to information disclosure.
This vulnerability is traded as CVE-2026-54317. It is possible to initiate the attack remotely. There is no exploit available.
Upgrading the affected component is recommended.
GHSA
Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
ghsa·2026-06-19·CVSS 4.3
CVE-2026-54317 [MEDIUM] CWE-200 Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
### Summary
The Konnected integration registers an HTTP endpoint, `KonnectedView` (`homeassistant/components/konnected/__init__.py`), that is marked as **not requiring authentication** (`requires_auth = False`). A comment next to that line says auth is instead handled "via the access token from configuration."
That promise is only half true:
- **Write requests (POST and PUT)** are handled by `update_sensor()`, which *does* check the request's `Authorization: Bearer ` header against the integration's stored access tokens (using `hmac.compare_digest`).
- **Read requests (GET)** are handled by a separate `get()` method that has **no authentication check at all.**
By sending
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-23
Published