ZDI-26-562: (Pwn2Own) Home Assistant Green mDNS Server-Side Request Forgery Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Aug 12, 2026 · Catalog

   Detected

   This vulnerability allows network-adjacent attackers to initiate arbitrary server-side requests on affected installations of Home Assistant Green. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.4. The following CVEs are assigned: CVE-2026-91129.

Sources

• CVE.orgVulnerability recordCVE-2026-91129

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-91129

  30-day exploitation probability 0.2%

  first.org
• Zero Day InitiativeCoordinated disclosureZDI-26-562

  This vulnerability allows network-adjacent attackers to initiate arbitrary server-side requests on affected installations of Home Assistant Green. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.4. The following CVEs are assigned: CVE-2026-91129.

  zerodayinitiative.com