In Assistant, developers have fixed two high-risk security vulnerabilities. Newly published vulnerability entries the problems. Additionally, the project has released an update for Assistant OS to version 18.
The most serious vulnerability affects an API endpoint that correctly checks for prior authentication for write access (PUT and POST) but fails to do so for read access (GET). This allows malicious actors with access to the Assistant HTTP port – default 8123 on the local network – to unauthorizedly view the status of the alarm panel and the device topology, explain the Assistant programmers ( CVE-2026-54317 , CVSS 7.6 , risk “ high ”). Assistant 2026.6.0, released earlier this month, closes the gap.
Any installed app in Assistant can send information to the BroadcastReceiver of the LocationSensorManager without further permissions; for example, broadcasts with a fake LocationResult from Google Play Service. The receiver trusts the information and accepts it as the device's real location. This could allow attackers to trigger zone-based automations, such as unlocking doors, deactivating alarms, or opening garages, write the Assistant developers in their security advisory . This has been corrected in Assistant Companion 2026.5.3 and newer ( CVE-2026-54318 , CVSS 7.1 , risk “ high ”).
Furthermore, the Assistant project has now released the operating system Assistant OS version 18. This is a minor maintenance release; the release announcement shows little new. The Linux kernel has been updated to the current 6.18 branch. Docker version 29.5.3 is included; containerd is at version 2.2.4; the programmers have updated the underlying Buildroot to 2025.02.14. The images should now flash significantly faster, and developers have also revised the logic for the swap file size. The Raspberry Pi bootloader can be updated directly from Assistant. Raspberry Pi 5 now requires at least firmware 2025-02-12 to be installed. Interested parties can find further details and download links in the release announcement.
Earlier this month, vulnerabilities in the Assistant companion apps were already disclosed. One of the gaps would have allowed attackers to intercept access tokens and thus take over the Assistant instance.
This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
