Home Assistant Green stores credentials in cleartext, enabling local privilege escalation
Attackers need low-privileged code in a container first; ZDI rates CVE-2026-91131 at CVSS 8.8.
46
Vulnerability1 · 1 read
CVE-2026-91131
- CVSS
- —
- EPSS
- —
- Published
- —
- Modified
- —
In the news
2 storiesHome Assistant Green aiohttp_client SSRF disclosed from Pwn2Own
ZDI rates CVE-2026-91131 at CVSS 5.4; network-adjacent attackers need no authentication.
42