Home Assistant's IPP integration prior to 2026.2.3 processes unauthenticated _ipp._tcp.local mDNS announcements, where attacker-controlled host, port, and base_path values are passed to validate_input for printer metadata retrieval. The shared HTTP client follows attacker-controlled cross-origin redirects and does not block loopback targets, enabling SSRF attacks that redirect requests to internal network services. This SSRF vulnerability (CWE-918) allows a local network attacker to make the Home Assistant server send requests to internal IP addresses without user interaction or prior IPP configuration. The vulnerability is resolved in version 2026.2.3.

An attacker on the local network can exploit this SSRF vulnerability to cause the Home Assistant server to send HTTP requests to internal services such as 127.0.0.1 or other internal IP addresses. This can potentially lead to information disclosure or interaction with internal services that are not otherwise exposed. The CVSS score is 5.4 (medium severity), reflecting limited scope and the requirement for local network access without privileges or user interaction.

Upgrade Home Assistant core to version 2026.2.3 or later, where this SSRF vulnerability is fixed. No additional mitigation is required as the official fix addresses the issue.