{"data":{"id":"eee15bf7-ef36-4b2c-93f6-bcc1bea57464","title":"GHSA-q855-8rh5-jfgq: ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path","summary":"The ha-mcp Home Assistant add-on, version 7.6.0 and earlier, mounts its settings UI routes at the bare root of port 9583 in addition to the MCP secret path. These root routes perform no authentication, no Origin check and no CSRF check, so any client that can reach the port can read or change tool visibility, feature flags, backups and the add-on itself. With Tool Security Policies enabled, the approval-policy API is also exposed, which can disable the human-approval gate on gated tools. Docker and standalone installs are not affected.","solution":"Fixed in PR homeassistant-ai/ha-mcp#1508 (merged to master): the root-mounted add-on routes are restricted to Home Assistant ingress, which originates from the Supervisor (172.30.32.2); all other callers receive 403. The fix ships in the next stable add-on release and is already on the dev channel (add-on dev build 7.6.0.dev393 or later).","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-q855-8rh5-jfgq","publishedAt":"2026-07-07T23:41:21.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["ha-mcp@< 7.10.0 (fixed: 7.10.0)"],"affectedPackageNames":["ha-mcp"],"affectedPackageRefs":["pypi:ha-mcp"],"affectedVendors":[],"affectedVendorsRaw":["ha-mcp","Home Assistant"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-q855-8rh5-jfgq"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-07-07T23:41:21.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null}}