High-Risk Vulnerabilities in Home Assistant Exposed

Heise.De

High-Risk Vulnerabilities in Home Assistant Exposed

First seen 24 Jun 2026, 15:55 UTC • •72.0

Article Content

1 / 4

Browse articles

ThreatCluster •June 25, 2026 at 15:40 UTC

•Two high-risk vulnerabilities in Home Assistant were disclosed on June 23, 2026.
•CVE-2026-54317 allows unauthorized access to sensitive information via an API flaw.
•CVE-2026-54318 enables local apps to spoof GPS locations, risking unauthorized automations.

On June 23, 2026, two critical vulnerabilities were disclosed in Home Assistant, an open-source automation platform. CVE-2026-54317 allows unauthorized access to alarm panel status and device topology via a misconfigured API endpoint. CVE-2026-54318 enables local malicious apps to spoof GPS locations, potentially triggering unauthorized automations like unlocking doors. Both vulnerabilities were addressed in the latest updates: Assistant OS version 18 and Assistant Companion version 2026.5.3. Users are urged to update their systems immediately to mitigate risks. The vulnerabilities were rated high risk, with CVSS scores of 7.6 and 7.1, respectively. The issues affect all versions prior to the updates, emphasizing the need for prompt action.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 113d ago How this analysis works

Timeline

2026-06-23

CVE-2026-54317 published

A vulnerability in Home Assistant allows unauthorized access to alarm panel status and device topology.

2026-06-23

CVE-2026-54318 published

This vulnerability permits local apps to spoof GPS locations, potentially triggering unauthorized actions.

2026-06-24

Updates released

Home Assistant released updates to fix the vulnerabilities, urging users to upgrade immediately.

More articles in this cluster (3)

Threat Graph

6 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Data Breach

Vulnerability (2)

CVE-2026-54317
CVE-2026-54318

Weakness (3)

CWE-200 - Exposure of Sensitive Information
CWE-287 - Improper Authentication
CWE-862 - Missing Authorization

Relationships

CVE-2026-54317 related to Data Breach
CVE-2026-54317 related to CVE-2026-54318
CVE-2026-54317 related to CWE-200 - Exposure of Sensitive Information
CVE-2026-54317 related to CWE-287 - Improper Authentication
CVE-2026-54317 related to CWE-862 - Missing Authorization

Following this threat?

Track CVE-2026-54317 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…

Silent Lynx Targets CIS Governments via WinRAR Exploit The threat actor Silent Lynx has launched a series of attacks against government organizations in the Commonwealth of Independent States (CIS) from June 2025 to August 2026. These attacks exploit a vulnerability in WinRAR (CVE-2025-8088) to deploy reverse shells, including FoalShell and PickleShell, facilitating…