CVE-2026-54317: Home Assistant Konnected integration missing authentication in KonnectedView

CVE-2026-54317 · Severity: high · CVSS 7.6 · Published 2026-06-23

Home Assistant is an open-source home automation platform used to control smart devices and security systems. A security flaw in its Konnected alarm panel integration allows anyone on the same local network to view the status of home security sensors, sirens, and switches without a password. This could allow an unauthorized person to determine if an alarm is currently sounding or to map out the security configuration of a home before a physical intrusion.

Technologies: homeassistant (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54317 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54317 being exploited in the wild.
How severe is CVE-2026-54317?
High severity, with a CVSS score of 7.6, published 23 June 2026.
Which products and versions are affected?
homeassistant (PyPI) < 2026.6.0, ECOSYSTEM:introduced=0,fixed=2026.6.0.
Is there a fix for CVE-2026-54317?
Yes. homeassistant (PyPI): upgrade to 2026.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54317 attacked?
It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-54317?
Check whether you run homeassistant (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • homeassistant (PyPI): upgrade to 2026.6.0 or later
    pip install "homeassistant>=2026.6.0"

Technical details

The Konnected integration in Home Assistant Core prior to 2026.6.0 contains a missing authentication vulnerability in its HTTP endpoint handler. While the 'KonnectedView' component (homeassistant/components/konnected/__init__.py) is globally marked with 'requires_auth = False', it only implements manual HMAC token verification for POST and PUT requests within the 'update_sensor()' method. The 'get()' method, which handles READ requests, lacks any authentication logic. An unauthenticated attacker on the local network can send GET requests to '/api/konnected/device/{device_id}' to enumerate valid device IDs, disclose the state of sirens and switches, and map the zone topology of the alarm panel. Additionally, each request triggers an outbound connection task to the hardware, which can be used for connection amplification attacks. This issue is resolved in version 2026.6.0.

Affected products

  • Home Assistant Home Assistant Core < 2026.6.0

Identifiers

  • CVE-2026-54317
  • GHSA-x84v-g949-293w
  • PYSEC-2026-241

Timeline

  • 2026-06-18: advisory: GitHub Security Advisory published
  • 2026-06-23: disclosed: NVD publication date
  • 2026-06-23: patched: Fix released in version 2026.6.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.