Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

ZDI publishes two Pwn2Own Home Assistant Green advisories under one CVE

1 source · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

ZDI published two Pwn2Own Home Assistant Green advisories, both tracked as CVE-2026-91131, with no versions or fixes listed.

On November 6, 2026, ZDI published two Pwn2Own advisories for Home Assistant Green and assigned both CVE-2026-91131. ZDI-26-896 describes local privilege escalation through cleartext credential storage; exploitation requires low-privileged code execution inside a container, and ZDI rates it CVSS 8.8. ZDI-26-897 describes unauthenticated server-side request forgery in aiohttp_client by network-adjacent attackers, rated CVSS 5.4. Neither advisory states affected versions, a fix, or whether the issues have been exploited.

Key facts
  • Both findings are labeled Pwn2Own and tracked as CVE-2026-91131.
  • ZDI-26-896 is cleartext credential storage leading to local privilege escalation.
  • ZDI rates ZDI-26-896 at CVSS 8.8 and requires container code execution.
  • ZDI-26-897 is unauthenticated SSRF in the aiohttp_client component.
  • ZDI rates ZDI-26-897 at CVSS 5.4 for network-adjacent attackers.
  • No affected versions, fixes, or exploitation status are stated.
Analyze CVE-2026-91131 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Nov 6, 2026ZDI publishes two Pwn2Own Home Assistant Green advisories · ZDI Published Advisories

What each outlet adds

beyond the shared facts
  • ZDI Published AdvisoriesZDI-26-896 needs container code execution and is rated CVSS 8.8.
  • ZDI Published AdvisoriesZDI-26-897 is unauthenticated network-adjacent SSRF rated CVSS 5.4.
CVEs
CVE-2026-91131
Vendors
Home Assistant
Products
Home Assistant Green
Organizations
Zero Day Initiative

Coverage

oldest first · one row per article · UTC
  1. · 5d ago ZDI Published AdvisoriesFirst report

    Home Assistant Green aiohttp_client SSRF disclosed from Pwn2Own

    ZDI rates CVE-2026-91131 at CVSS 5.4; network-adjacent attackers need no authentication.

  2. · 5d ago ZDI Published Advisories

    Home Assistant Green stores credentials in cleartext, enabling local privilege escalation

    Attackers need low-privileged code in a container first; ZDI rates CVE-2026-91131 at CVSS 8.8.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-91131
———