CVE-2026-34205: Home Assistant Supervisor: unauthenticated endpoints exposed to the local network by host-network apps

Overview

Home Assistant apps (formerly add-ons) that use host network mode can expose endpoints that are meant to be reachable only internally, through the Docker bridge interface. According to the record, on Linux this binding does not restrict access as intended, so endpoints that should not be visible to the rest of the local network can be reached without authentication. The weakness is classified as CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints).

Impact

• The record describes unauthenticated access to these endpoints by any device on the same local network.
• The CVSS 3.1 vector in the record (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) indicates network-adjacent access, no privileges or user interaction required, scope change, and high impact on confidentiality, integrity and availability. The score of 9.6 is provided by the CNA.
• The record does not describe what data or actions the exposed endpoints allow, so the specific consequences remain unknown.

Affected products and versions

• Product: Home Assistant apps (formerly add-ons) configured with host network mode, running on Linux, according to the record.
• The record does not list affected version ranges, and the affected and fixed fields are empty.
• The description states that Home Assistant Supervisor 2026.03.02 addresses the issue. Earlier Supervisor releases are therefore likely to be the ones affected, but the exact range is unknown from the available data.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The EPSS probability in the record is low (0.00346, percentile 0.26275), which is a statistical estimate and not evidence of exploitation.

Remediation and mitigation

• Update Home Assistant Supervisor to version 2026.03.02 or later, as stated in the record.
• Review which apps use host network mode and confirm whether any of them are exposed on the local network.
• Where an update is not immediately possible, limit access to the host's local network segment, for example through network segmentation, so that only trusted devices can reach the Home Assistant host.
• Consult the official advisory for full remediation guidance and any additional steps.

Detection guidance

• Inventory installed apps and identify those configured with host network mode on Linux systems.
• Review local network logs or firewall records for unexpected connections to Home Assistant hosts from devices that should not require access.
• Verify the installed Supervisor version against the fixed release 2026.03.02.

Limitations of the available information

• The record has no title, no affected version ranges, no fixed version field and no CWE name.
• The record does not describe the endpoints, the requests they accept or the data they expose.
• The sources consulted do not include vendor-specific technical details beyond the GitHub advisory reference.
• The EPSS date in the record is later than the publication date and should be treated with caution.

Frequently asked questions

What is CVE-2026-34205?

It is a weakness in Home Assistant apps configured with host network mode. On Linux, their endpoints can be reached without authentication by any device on the same local network, according to the record.

Which version fixes the issue?

The record states that Home Assistant Supervisor 2026.03.02 addresses the issue. The affected version range is not listed in the record.

Is this vulnerability being exploited?

The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.