CVE-2026-32111

ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form (beta feature) accepts a user-supplied ha_url and makes a server-side HTTP request to {ha_url}/api/config with no URL validation. An unauthenticated attacker can submit arbitrary URLs to perform internal network reconnaissance via an error oracle. Two additional code paths in OAuth tool calls (REST and WebSocket) are affected by the same primitive. The primary deployment method (private URL with pre-configured HOMEASSISTANT_TOKEN) is not affected. This vulnerability is fixed in 7.0.0.

• CWE-918

• https://github.com/homeassistant-ai/ha-mcp/security/advisories/GHSA-fmfg-9g7c-3vq7Vendor Advisory

Published

Mar 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32106StudioCMS is a server-side-rendered, Astro native, headless …7.2
• CVE-2026-32107xrdp is an open source RDP server. In versions through 0.10.…8.8
• CVE-2026-32108Copyparty is a portable file server. Prior to 1.20.12, there…6.5
• CVE-2026-32109Copyparty is a portable file server. Prior to 1.20.12, if an…4.4
• CVE-2026-3211Cross-Site Request Forgery (CSRF) vulnerability in Drupal Th…4.3
• CVE-2026-32110SiYuan is a personal knowledge management system. Prior to 3…8.3
• CVE-2026-32112ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the h…4.7
• CVE-2026-32113Discourse is an open-source discussion platform. From versio…6.1
• CVE-2026-32114Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-32116Magic Wormhole makes it possible to get arbitrary-sized file…8.1
• CVE-2026-32117The grafanacubism-panel plugin allows use of cubism.js in Gr…5.4
• CVE-2026-32118OpenEMR is a free and open source electronic health records …9