Home Assistant EUVD-2026-84804

Requires the attacker to be on the same local network segment as the Home Assistant instance (AV:A) in order to send the crafted _ipp._tcp.local mDNS announcement. The IPP integration must be present and its zeroconf discovery active - but exploitation needs NO prior IPP printer configuration, NO authentication (PR:N), and NO user interaction (UI:N), because async_step_zeroconf automatically passes the attacker-controlled host, port, and base_path to validate_input. The core enabling condition is that the shared HTTP client followed attacker-controlled cross-origin redirects to loopback/internal addresses without blocking them; this is present in all versions prior to 2026.2.3. The primary limiting factors are the adjacent-network requirement (not internet-exploitable) and the constrained impact (loopback/internal request coercion within printer-metadata retrieval, not arbitrary response exfiltration).

This is a genuine but moderate-severity issue whose real-world risk is bounded primarily by the adjacent-network attack vector. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N = 5.4) is internally consistent with the description: exploitation is unauthenticated (PR:N) and needs no user interaction (UI:N), but the attacker must be on the same local network segment to emit the crafted mDNS announcement (AV:A) - this is NOT internet-remote SSRF, which materially limits exposure. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so this is not a confirmed exploitation priority. The impact is deliberately scoped as low (C:L/I:L, A:N): the SSRF lets an attacker coerce the Home Assistant HTTP client into reaching loopback/internal services via attacker-controlled redirects, but the response handling is limited to printer-metadata retrieval rather than full read/write of arbitrary internal responses. The signals are consistent (no conflict between CVSS and description), and the vendor has confirmed both the root cause and the fix, so treat this as a patch-in-normal-cycle item for exposed/shared-network deployments rather than an emergency.

An attacker on the same LAN as a Home Assistant instance broadcasts a spoofed _ipp._tcp.local mDNS announcement; the IPP integration automatically processes it and issues an HTTP request to the attacker's advertised host/port/base_path. The attacker's server responds with a cross-origin redirect to 127.0.0.1 or another internal address, and because the shared HTTP client followed redirects to loopback without blocking, the request is coerced against an internal service with no user interaction or prior IPP setup. No weaponized public exploit was provided, though the fix commit includes test-server code demonstrating the redirect behavior.