# Home Assistant MCP Server unauthenticated access to YAML backups

Source: https://junglewise.ai/threats/home-assistant-mcp-server-unauthenticated-access-to-yaml-backups-d620653e  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 6.5 · Published 2026-05-14

The Home Assistant MCP Server integration, which allows AI models to interact with Home Assistant, contains a vulnerability where configuration backups are stored in a publicly accessible folder. If the YAML editing feature is enabled, any user on the same network can download these backups without a password. These files often contain sensitive information such as plaintext passwords for smart home services, security credentials, and private location coordinates.

Technologies: [ha-mcp (PyPI)](https://junglewise.ai/threats/technologies/ha-mcp). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 6.5, published 14 May 2026.

**Which products and versions are affected?** ha-mcp (PyPI) < 7.5.0.

**Is there a fix for This vulnerability?** A patch was published on 2026-05-14: Fixed in version 7.5.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected?** Check whether you run ha-mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as CWE-552 (Files or Directories Accessible to External Parties). When 'ENABLE_YAML_CONFIG_EDITING' is set to true, the 'ha_config_set_yaml' function saves backups to the 'www/yaml_backups/' directory. By design, Home Assistant serves the 'www/' directory at the '/local/' endpoint without authentication to facilitate static dashboard assets. An attacker on the local network (or internet if the instance is exposed) can guess or discover the backup filenames—which use a predictable timestamp format—and download them without credentials. These backups typically contain sensitive data like MQTT passwords and REST credentials. The issue is fixed in version 7.5.0 by moving backups to a non-public directory and migrating existing files.

## Affected products

- homeassistant-ai ha-mcp < 7.5.0

## Timeline

- 2026-05-08: disclosed: Vulnerability reported and published to repository advisory database.
- 2026-05-14: advisory: GitHub Advisory GHSA-g39v-cvjh-8fpf published.
- 2026-05-14: patched: Fixed in version 7.5.0.

## References

- [https://api.github.com/users/bharat](https://api.github.com/users/bharat)
- [https://github.com/bharat](https://github.com/bharat)
- [https://api.github.com/users/bharat/gists%7B/gist_id%7D](https://api.github.com/users/bharat/gists%7B/gist_id%7D)
- [https://api.github.com/users/bharat/repos](https://api.github.com/users/bharat/repos)
- [https://avatars.githubusercontent.com/u/54570?v=4](https://avatars.githubusercontent.com/u/54570?v=4)
- [https://api.github.com/users/bharat/events%7B/privacy%7D](https://api.github.com/users/bharat/events%7B/privacy%7D)

## Related threats

- [PYSEC-2026-2508 - ha-mcp has XSS via Unescaped HTML in OAuth Consent Form](https://junglewise.ai/threats/cve-2026-32112-ha-mcp-has-xss-via-unescaped-html-in-oauth-consent-form)
- [PYSEC-2026-2507 - ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle](https://junglewise.ai/threats/cve-2026-32111-ha-mcp-oauth-2-1-dcr-mode-enables-network-reconnaissance-via-an)
- [homeassistant-ai ha-mcp missing authentication in settings routes](https://junglewise.ai/threats/homeassistant-ai-ha-mcp-missing-authentication-in-settings-routes-7bec1052)