Executive brief
A vulnerability in the ha-mcp Home Assistant add-on allows unauthorized access to its settings and configuration interface. An attacker on the same network could change tool visibility, delete backups, or restart the add-on without needing a password. This does not grant access to sensitive Home Assistant credentials or private data, but it can disrupt the add-on's operation.
Technical details
The ha-mcp add-on (v7.6.0 and earlier) incorrectly mounts its settings UI routes at the bare root of port 9583 without authentication, CSRF protection, or origin checks. This allows any network-reachable client to invoke sensitive API endpoints such as /api/settings/tools, /api/settings/backups, and /api/settings/restart. While the core MCP endpoint remains protected by a secret path, the exposed routes allow for unauthorized configuration changes, backup deletion, and service restarts. The vulnerability is specific to Home Assistant add-on installations with host networking enabled and port 9583 published. A fix was introduced in version 7.10.0 by restricting root-mounted routes to the Home Assistant Supervisor IP.
Affected products
- homeassistant-ai ha-mcp < 7.10.0
Timeline
- 2026-05-31: disclosed
- 2026-07-07: advisory