CVE-2026-34205

Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (formerly add-ons) configured with host network mode expose unauthenticated endpoints bound to the internal Docker bridge interface to the local network. On Linux, this configuration does not restrict access to the app as intended, allowing any device on the same network to reach these endpoints without authentication. Home Assistant Supervisor 2026.03.02 addresses the issue.

• CWE-923

• https://github.com/home-assistant/core/security/advisories/GHSA-gh5m-4m97-c95h

Published

Mar 27, 2026

Last Modified

Jun 17, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34197Improper Input Validation, Improper Control of Generation of…8.8
• CVE-2026-34198Coolify is an open-source and self-hostable tool for managin…5.3
• CVE-2026-34200Nhost is an open source Firebase alternative with GraphQL. P…7.5
• CVE-2026-34202ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…7.5
• CVE-2026-34203Nautobot is a Network Source of Truth and Network Automation…4.3
• CVE-2026-34204MinIO is a high-performance object storage system. Prior to …7.1
• CVE-2026-34206Captcha Protect is a Traefik middleware to add an anti-bot c…6.1
• CVE-2026-34207TypeBot is a chatbot builder tool. In versions prior to 3.16…7.6
• CVE-2026-34208SandboxJS is a JavaScript sandboxing library. Prior to 0.8.3…10
• CVE-2026-34209mppx is a TypeScript interface for machine payments protocol…7.5
• CVE-2026-34210mppx is a TypeScript interface for machine payments protocol…8.1
• CVE-2026-34211SandboxJS is a JavaScript sandboxing library. Prior to 0.8.3…7.5