Home Assistant Green aiohttp_client SSRF disclosed from Pwn2Own
Original title: ZDI-26-897: (Pwn2Own) Home Assistant Green aiohttp_client Server-Side Request Forgery Vulnerability
ZDI rates CVE-2026-91131 at CVSS 5.4; network-adjacent attackers need no authentication.
ZDI published ZDI-26-897, a server-side request forgery in the aiohttp_client component of Home Assistant Green, credited to Pwn2Own and tracked as CVE-2026-91131. Network-adjacent attackers can initiate arbitrary server-side requests without authentication. ZDI assigned a CVSS rating of 5.4. Affected versions, a fix, and exploitation status are not stated.
- The flaw is CVE-2026-91131 and advisory ZDI-26-897.
- It is labeled as a Pwn2Own finding.
- Authentication is not required for network-adjacent attackers.
- ZDI assigned a CVSS rating of 5.4.
Impact: Unauthenticated adjacent server-side request forgery
| Product | Affected |
|---|---|
| Home Assistant Green | — |
- CVEs
- CVE-2026-91131
- Vendors
- Home Assistant
- Products
- Home Assistant Green
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91131 | — | — | — |
From the original article
This vulnerability allows network-adjacent attackers to initiate arbitrary server-side requests on affected installations of Home Assistant Green. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.