Junglewise Threat Intelligence

homeassistant-ai ha-mcp missing authentication in settings routes

Severity: medium · CVSS 6.5 · Published 2026-07-07

Technologies: Homeassistant-Ai Ha-Mcp. Vendors: PyPI.

Executive brief

A vulnerability in the ha-mcp Home Assistant add-on allows unauthorized access to its settings and configuration interface. An attacker on the same network could change tool visibility, delete backups, or restart the add-on without needing a password. This does not grant access to sensitive Home Assistant credentials or private data, but it can disrupt the add-on's operation.

Technical details

The ha-mcp add-on (v7.6.0 and earlier) incorrectly mounts its settings UI routes at the bare root of port 9583 without authentication, CSRF protection, or origin checks. This allows any network-reachable client to invoke sensitive API endpoints such as /api/settings/tools, /api/settings/backups, and /api/settings/restart. While the core MCP endpoint remains protected by a secret path, the exposed routes allow for unauthorized configuration changes, backup deletion, and service restarts. The vulnerability is specific to Home Assistant add-on installations with host networking enabled and port 9583 published. A fix was introduced in version 7.10.0 by restricting root-mounted routes to the Home Assistant Supervisor IP.

Affected products

  • homeassistant-ai ha-mcp < 7.10.0

Timeline

  • 2026-05-31: disclosed
  • 2026-07-07: advisory

References

Related threats