Home Assistant Green SSDP Server‑Side Request Forgery (CVE‑2026‑XXXX) Exposes Internal Network to Unauthenticated Attackers
What Happened — A CVE‑2026‑XXXX SSRF flaw (CVSS 5.4) was discovered in Home Assistant Green’s Simple Service Discovery Protocol (SSDP) handling. An unauthenticated, network‑adjacent attacker can craft malicious SSDP headers that cause the appliance to issue arbitrary outbound requests, potentially chaining to remote code execution as root. Home Assistant has released a patch (see GitHub PR #156622).
Why It Matters for Compliance & Audit Readiness
- SSRF bypasses network‑segmentation controls, a classic SOC 2 CC6 (System and Communications Protection) failure point.
- Continuous‑compliance programs must map this gap to a control, evidence remediation, and demonstrate ongoing monitoring of input‑validation controls.
- Verisq’s Control Mapping capability can automatically align the SSDP fix to SOC 2 criteria and generate audit‑ready evidence of remediation.
Who Is Affected – Smart‑home SaaS/IoT platforms, managed service providers offering Home Assistant Green, and downstream customers that deploy the appliance in residential or small‑business environments.
Recommended Actions –
- Apply the Home Assistant Green patch immediately.
- Map the SSDP input‑validation control to SOC 2 CC6 and capture remediation evidence in your continuous‑compliance repository.
- Enable network‑segmentation monitoring to detect anomalous outbound requests from IoT devices.
Source: Zero Day Initiative advisory
Technical Notes – The SSRF stems from insufficient URI validation in SSDP headers (network‑adjacent attacker, no auth required). Exploitation can be combined with other flaws for root‑level code execution. CVSS 5.4 (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Source: same advisory