GHSA-q855-8rh5-jfgq: ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path

Summary

The ha-mcp Home Assistant add-on, version 7.6.0 and earlier, mounts its settings UI routes at the bare root of port 9583 in addition to the MCP secret path. These root routes perform no authentication, no Origin check and no CSRF check, so any client that can reach the port can read or change tool visibility, feature flags, backups and the add-on itself. With Tool Security Policies enabled, the approval-policy API is also exposed, which can disable the human-approval gate on gated tools. Docker and standalone installs are not affected.

Mitigation

Fixed in PR homeassistant-ai/ha-mcp#1508 (merged to master): the root-mounted add-on routes are restricted to Home Assistant ingress, which originates from the Supervisor (172.30.32.2); all other callers receive 403. The fix ships in the next stable add-on release and is already on the dev channel (add-on dev build 7.6.0.dev393 or later).

Related items

• MediumCVE-2026-108759: mistral.rs sandbox escape via symlinks in mistralrs-code-execSimilar attack · NVD/CVE Database
• MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySimilar attack · NVD/CVE Database
• MediumCVE-2026-108574: BerriAI LiteLLM authorization bypass in session spend log view via session_idSimilar attack · NVD/CVE Database
• MediumCVE-2026-108670: JeecgBoot missing authorization in AiragPromptsControllerSimilar attack · NVD/CVE Database
• MediumCVE-2026-108600: open-multi-agent link following flaw in file_write tool sandboxSimilar attack · NVD/CVE Database