Executive Summary

A server‑side request forgery (SSRF) flaw in Home Assistant Green’s aiohttp_client component lets unauthenticated, network‑adjacent attackers trigger arbitrary outbound requests. The vulnerability, identified as CVE‑2026‑91131 and assigned CVSS 5.4, was showcased in the Pwn2Own contest (ZDI‑26‑897). No authentication is required, making it exploitable by local network actors.

---

Intelligence Metadata - Source Publisher: Zero Day Initiative - Published Date: 2026-11-06T06:00:00+00:00 - Category: cves

Original Description: This vulnerability allows network-adjacent attackers to initiate arbitrary server-side requests on affected installations of Home Assistant Green. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.4. The following CVEs are assigned: CVE-2026-91131.

"Better to have loved and lost, than to have never loved at all."

— St. Augustine