Threats tagged 'ghsa-q855-8rh5-jfgq'

In ha-mcp add-on mode for Home Assistant, certain settings and policy routes are accessible without authentication at the bare root path on port 9583 in versions prior to 7.10.0. This allows any client able to reach this port to read or modify add-on configurations, toggle feature flags, manage backups, restart the add-on, and alter approval policies if enabled, without requiring authentication. The vulnerability does not expose Home Assistant data, credentials, or allow code execution. The issue is fixed by restricting root path access to Home Assistant ingress only, with the fix included in versions 7.10.0 and later.