CVE-2026-66060: falha de alta gravidade em home-assistant core
Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.2%
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue is fixed in version 2026.8.1.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Produtos afetados
home-assistant · coreCVEs relacionadas — home-assistant core
No mesmo produto, das mais perigosas para as menos.
CVE-2023-27482CRITICALCVE-2023-27482EPSS 72.2%CVE-2023-41897HIGHLack of XFO header allows clickjacking in Home Assistant CoreEPSS 1.1%CVE-2023-50715MEDIUMUser accounts disclosed to unauthenticated actors on the LANEPSS 0.9%CVE-2023-41895HIGHCross-site Scripting via auth_callback login in Home Assistant CoreEPSS 0.7%CVE-2023-41899MEDIUMPartial Server-Side Request Forgery in Home Assistant Core EPSS 0.6%CVE-2023-41894MEDIUMLocal-only webhooks externally accessible via SniTun in Home Assistant CoreEPSS 0.5%