CVE-2026-91131

CVSS

—

EPSS

—

CISA KEV

Not listed

Exploitation

No report

Public exploits

None seen

State

Unknown

Coverage

• Zero Day Initiative — published12 Aug, 05:00

  ZDI-26-563: (Pwn2Own) Home Assistant Green Simple Service Discovery Protocol Server-Side Request Forgery Vulnerability

  This vulnerability allows network-adjacent attackers to initiate arbitrary server-side requests on affected installations of Home Assistant Green. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.4. The following CVEs are assigned: CVE-2026-91131.

  ↗zerodayinitiative.com/advisories/ZDI-26-563(opens the publisher's site in a new tab)

What we observed