ZDI-CAN-28461: ZDI-26-896: (Pwn2Own) Home Assistant Green Cleartext Storage of Credentials Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Home Assistant Green. An attacker must first obtain the ability to execute low-privileged code within a container on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-91131.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Affected Home Assistant Green installations are exposed only after an attacker can execute low-privileged code within a container on the target system. The issue is a local privilege-escalation vulnerability rather than a remotely exploitable condition based on the available information.
What access does an attacker need before exploiting it?
The attacker must first obtain the ability to execute low-privileged code within a container on the target system. No other prerequisite or attack path is specified in the available data.