ZDI-CAN-28361: ZDI-26-897: (Pwn2Own) Home Assistant Green aiohttp_client Server-Side Request Forgery Vulnerability
Published Nov 6, 2026
·Updated
This vulnerability allows network-adjacent attackers to initiate arbitrary server-side requests on affected installations of Home Assistant Green. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.4. The following CVEs are assigned: CVE-2026-91131.
Event History
Nov 6, 2026
Advisory Published
via ZDI·06:00 AM
Data Sourced
via ZDI·06:00 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
A network-adjacent attacker can exploit it against an affected Home Assistant Green installation. Authentication is not required.
2
What access does an attacker gain through successful exploitation?
Successful exploitation allows the attacker to initiate arbitrary server-side requests from the affected installation.