Blueprint Studio's terminal SSH key authentication in custom_components/blueprint_studio/backend/terminal_manager.py wrote SSH private keys to a file under the Home Assistant configuration directory before applying restrictive permissions and relied on best-effort cleanup. This could lead to residual private key material persisting on disk if cleanup failed or if Home Assistant crashed, exposing sensitive credentials to any user or process with filesystem access to the configuration directory. The vulnerability is identified as CWE-522 (Insufficiently Protected Credentials) and is fixed in version 2.5.2.

An attacker or unauthorized user with filesystem access to the Home Assistant configuration directory could obtain residual SSH private keys left on disk due to insufficient cleanup. This exposure could lead to unauthorized SSH access or credential compromise. The CVSS 4.0 score is 5.6 (medium severity), reflecting the local attack vector, required privileges, and partial confidentiality impact.

Upgrade blueprint-studio to version 2.5.2 or later, where this issue is fixed. Until then, restrict filesystem access to the Home Assistant configuration directory to trusted users and processes only. Monitor for any unexpected files containing SSH keys in the configuration directory and remove them if found. Patch status is not explicitly stated beyond the fix in 2.5.2; check vendor advisories for further updates.