Description
ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form (beta feature) accepts a user-supplied ha_url and makes a server-side HTTP request to {ha_url}/api/config with no URL validation. An unauthenticated attacker can submit arbitrary URLs to perform internal network reconnaissance via an error oracle. Two additional code paths in OAuth tool calls (REST and WebSocket) are affected by the same primitive. The primary deployment method (private URL with pre-configured HOMEASSISTANT_TOKEN) is not affected. This vulnerability is fixed in 7.0.0.
Published: 2026-03-11
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Upgrade
AI Analysis

Impact

The vulnerability occurs in the OAuth consent form of ha-mcp (Home Assistant MCP Server) where an unauthenticated user can supply an arbitrary ha_url that the server uses to perform a server‑side HTTP request to {ha_url}/api/config without validating the URL. This behavior constitutes a Server‑Side Request Forgery (CWE‑918) and allows the attacker to trigger error responses, which serve as an oracle for discovering internal network information, resulting in information disclosure.

Affected Systems

Affected products include homeassistant‑ai:ha‑mcp. All versions prior to 7.0.0 are impacted; the fix is delivered in 7.0.0.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is below 1 %, with no listing in the CISA KEV catalog. Exploitation requires an unauthenticated attacker to submit arbitrary URLs during the OAuth consent flow; the weakness is limited to internal network reconnaissance and does not provide remote code execution or elevated privileges.

Generated by OpenCVE AI on March 17, 2026 at 17:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to ha-mcp 7.0.0 or newer

Generated by OpenCVE AI on March 17, 2026 at 17:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-fmfg-9g7c-3vq7 ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle
History

Tue, 17 Mar 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Homeassistant-ai home Assistant Mcp Server
CPEs cpe:2.3:a:homeassistant-ai:home_assistant_mcp_server:*:*:*:*:*:*:*:*
Vendors & Products Homeassistant-ai home Assistant Mcp Server

Thu, 12 Mar 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 12 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Homeassistant-ai
Homeassistant-ai ha-mcp
Vendors & Products Homeassistant-ai
Homeassistant-ai ha-mcp

Wed, 11 Mar 2026 21:00:00 +0000

Type Values Removed Values Added
Description ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form (beta feature) accepts a user-supplied ha_url and makes a server-side HTTP request to {ha_url}/api/config with no URL validation. An unauthenticated attacker can submit arbitrary URLs to perform internal network reconnaissance via an error oracle. Two additional code paths in OAuth tool calls (REST and WebSocket) are affected by the same primitive. The primary deployment method (private URL with pre-configured HOMEASSISTANT_TOKEN) is not affected. This vulnerability is fixed in 7.0.0.
Title ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Homeassistant-ai Ha-mcp Home Assistant Mcp Server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-03-12T14:03:53.910Z

Reserved: 2026-03-10T22:02:38.855Z

Link: CVE-2026-32111

cve-icon Vulnrichment

Updated: 2026-03-12T14:03:49.217Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-11T21:16:17.267

Modified: 2026-03-17T15:37:53.473

Link: CVE-2026-32111

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-20T15:37:06Z

Weaknesses