ZDI-26-897: (Pwn2Own) Home Assistant Green aiohttp_client Server-Side Request Forgery Vulnerability
Published Nov 6, 2026
·Updated
This vulnerability allows network-adjacent attackers to initiate arbitrary server-side requests on affected installations of Home Assistant Green. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.4. The following CVEs are assigned: CVE-2026-91131.
Event History
Nov 6, 2026
Advisory Published
via ZDI·06:00 AM
Data Sourced
via ZDI·06:00 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
A network-adjacent attacker can exploit it without authentication. The affected product identified is Home Assistant Green.
2
What can a successful attacker do?
A successful attacker can cause the affected installation to initiate arbitrary server-side requests.
3
How severe is the issue according to the available advisory data?
ZDI assigned the vulnerability a CVSS score of 5.4. The associated identifier is CVE-2026-91131.