What is the CVSS score of CVE-2026-34205?

CVE-2026-34205 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-34205?

Yes, a public proof-of-concept exploit is available for CVE-2026-34205. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-34205?

Within 24 hours: Identify all Home Assistant Supervisor instances running versions prior to 2026.03.02 using network asset inventory or configuration management tools. Within 7 days: Update all affected Supervisor instances to version 2026.03.02 or later via official vendor channels; verify Docker host network mode configurations post-patch and disable where not operationally required. Within 30 days: Audit network segmentation for all Home Assistant deployments; restrict Layer 2 access to Home Assistant Docker hosts using VLAN isolation or network access controls; document and test failover procedures for any automation dependent on Supervisor connectivity.

Docker CVE-2026-34205

Q: Which versions of Docker are affected by CVE-2026-34205?

Home Assistant Supervisor versions prior to 2026.03.02 contain a critical network isolation bypass affecting Docker-based deployments on Linux, allowing any device on the local network to access…. A patch is available.

EUVD-2026-16793 CRITICAL

Improper Restriction of Communication Channel to Intended Endpoints (CWE-923)

2026-03-27 security-advisories@github.com

Information Disclosure Docker

9.6

CVSS 3.1 · Vendor: github

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Position attacker on same network as Home Assistant
Exploit

Discover exposed unauthenticated endpoints on Docker bridge
Execution

Send requests to internal services
Impact

Execute arbitrary commands or access sensitive data

Vulnerability Assessment

Weakness	CWE CWE-923 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V12 - Secure Communication Improper restriction of communication channel
Exploitation Conditions	Home Assistant apps configured with host network mode on Linux. Attacker must be on the same local network as the Home Assistant instance. No authentication required. Affects Home Assistant Supervisor versions prior to 2026.03.02.
Impact	Real-world risk is critically high for Home Assistant deployments on the same network segment as untrusted devices. The CVSS vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) indicates adjacent network attack vector with low complexity, no privileges required, no user interaction, and scope change with complete confidentiality, integrity, and availability impact. Attack complexity is low because exploitation requires only network connectivity to the same broadcast domain or VLAN as the Home Assistant host-no credentials, social engineering, or race conditions needed. The PR:N (no privileges required) confirms unauthenticated access. Scope change (S:C) reflects that compromising the Docker-isolated app can impact the broader Home Assistant system or host. No public exploit identified at time of analysis, though the attack surface is trivially discoverable via network scanning. EPSS data not provided, but the combination of critical CVSS, adjacent network requirement (limiting remote internet-based attacks), and authentication bypass elevates priority for home and small business networks where segmentation is weak. For enterprises with proper VLAN isolation separating IoT/home automation from general user networks, risk is mitigated. However, residential deployments typically lack this segmentation, making this a patch-now scenario. The availability of a vendor patch in version 2026.03.02 significantly reduces residual risk for those who upgrade promptly.
Exploit ScenarioDerived	An attacker connected to the same residential Wi-Fi network as a vulnerable Home Assistant instance uses a network scanning tool to enumerate open ports on the 172.17.0.0/16 Docker bridge subnet range that are unexpectedly reachable from the LAN. The attacker discovers an unauthenticated API endpoint for a third-party app (such as a database management interface, MQTT broker, or media server) that was intended to be isolated within Docker. Without authentication, the attacker sends API requests to modify app configuration, extract sensitive data including device credentials or automation logic, or inject malicious commands that execute within the app container. Due to the scope change indicated in the CVSS vector, successful exploitation of the app could allow lateral movement to compromise the Home Assistant core system or underlying host, enabling persistent access to control smart home devices, surveillance cameras, and security systems.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 27, 2026

Unauthenticated network access to Home Assistant apps bypasses intended Docker isolation on Linux systems, exposing internal services to any device on the local network. Apps configured with host network mode inadvertently bind internal Docker bridge endpoints to the broader LAN without authentication controls, enabling unauthorized access with high confidentiality, integrity, and availability impact (CVSS 9.6). Vendor-released patch available in Home Assistant Supervisor 2026.03.02. No public exploit identified at time of analysis, though exploitation requires only adjacent network access with low attack complexity.

RemediationAI

Upgrade Home Assistant Supervisor to version 2026.03.02 or later, which implements proper network isolation controls for apps using host network mode. The patch enforces iptables rules or network namespace boundaries to restrict Docker bridge interface endpoints to their intended scope, preventing LAN-wide exposure. Administrators should navigate to Settings > System > Updates in the Home Assistant web interface and apply the Supervisor update immediately. For systems unable to patch immediately, implement network-level mitigation by isolating the Home Assistant host on a dedicated VLAN or network segment with firewall rules permitting only necessary inbound connections from trusted management devices. Review all installed apps configured with host network mode and assess whether this configuration is required-switching to bridge mode (default) where feasible eliminates the attack surface entirely, though this may break functionality for apps requiring direct host network access. Conduct a security audit of exposed services using network scanning tools like nmap from an adjacent host to identify which endpoints became accessible pre-patch. Full remediation guidance and technical discussion available in the GitHub security advisory at https://github.com/home-assistant/core/security/advisories/GHSA-gh5m-4m97-c95h.

Affected VersionsENISA

Home Assistant Operating System ≤ 17.1

Home Assistant Supervisor < 2026.03.2

Affected Packages

euvd home_assistant_operating_system no fix

euvd home_assistant_supervisor fix: 2026.03.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Home Assistant is an open-source home automation platform emphasizing local control and privacy. The vulnerability stems from CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints), specifically affecting the Docker networking configuration on Linux hosts. Apps (formerly called add-ons) using host network mode are intended to isolate services on the internal Docker bridge interface (typically docker0, 172.17.0.0/16 range). However, the configuration fails to properly restrict these endpoints, causing services that should only be accessible within the Docker network namespace to become reachable from any host on the same physical or virtual LAN. This misconfiguration exposes unauthenticated API endpoints, management interfaces, or service ports that lack authentication because they were designed to operate in a trusted internal context. The issue is specific to Linux implementations of Home Assistant Supervisor's Docker networking stack, where iptables rules or network namespace isolation do not adequately enforce the intended boundary between the Docker bridge and the external network interface.

Know when Docker gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 9.6 CRITICAL

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (github) · only source for this CVE.

CVSS VectorVendor: github

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:48 EUVD-patch-fix

executive summary

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.03.2

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

CVE Published

Mar 27, 2026 - 20:16 nvd

CRITICAL 9.6

DescriptionCVE.org

Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (formerly add-ons) configured with host network mode expose unauthenticated endpoints bound to the internal Docker bridge interface to the local network. On Linux, this configuration does not restrict access to the app as intended, allowing any device on the same network to reach these endpoints without authentication. Home Assistant Supervisor 2026.03.02 addresses the issue.

Executive ViewAI

Why It Matters

Home Assistant Supervisor versions prior to 2026.03.02 contain a critical network isolation bypass affecting Docker-based deployments on Linux, allowing any device on the local network to access internal services without authentication. Organizations using Home Assistant for smart home automation or IoT management face immediate risk of unauthorized access to sensitive automation logic, device control, and user data. This vulnerability requires only network proximity-not authentication-and carries a CVSS score of 9.6, making it a priority for immediate remediation across all affected deployments.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is infeasible: (1) isolate Home Assistant Supervisor to a dedicated network segment with explicit access control lists limiting Layer 2 access from end-user devices; (2) disable host network mode for non-critical Docker containers and use bridge networking with explicit port mapping; (3) implement network monitoring to detect unauthorized access attempts to Docker bridge endpoints; (4) require VPN or firewall rules restricting access to Supervisor management interfaces from trusted IPs only. These controls reduce but do not eliminate risk-patching remains mandatory.

Threat Intelligence Overview

EPSS Score

0.0%

Top 95% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Controlled

Automatable

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +48

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.