Home Assistant add-ons configured for host network mode expose unsecured endpoints bound to the Docker bridge interface, allowing any device on the same local network to reach them without authentication. The flaw stems from improper isolation of the Docker bridge, categorised as CWE-923, and can lead to unauthorized disclosure or manipulation of data managed by those add-ons.

Systems running Home Assistant Operating System with Home Assistant Supervisor prior to the 2026.03.02 update are affected. The vulnerability targets add-ons that use host network mode; any such add-on installed on these systems is vulnerable.

The CVSS score of 9.7 marks the issue as critical. Exploitation requires no special skills—a device on the same local network can simply connect to the exposed endpoint. Though EPSS data is unavailable, the high score and lack of mitigating controls suggest a high likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog.