Am I affected by ha-mcp: Add-on settings and policy routes are reachable without authentication at the…? What should I do?
In add-on mode, the ha-mcp settings UI routes are mounted both under the MCP secret path and at the bare root of the published port (
:9583).Affected: ha-mcp < 7.10.0 (Home Assistant add-on installations v7.6.0 and earlier). Fixed in: 7.10.0. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/07/ghsa-q855-8rh5-jfgq-ha-mcp (opens external site)
1 answer
Am I affected? Affected: ha-mcp < 7.10.0 (Home Assistant add-on installations v7.6.0 and earlier). Fixed in: 7.10.0.
- Check your version: run
pip show ha-mcp. Versions < 7.10.0 of ha-mcp are affected.
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "ha-mcp>=7.10.0"(first patched version 7.10.0). - If you'd rather have the fix now, it is already on the dev channel (add-on dev build 7.6.0.dev393 or later).
- Use the settings UI under the MCP secret path (
…/<secret>/settings) for direct and remote access.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- GitHub Advisory Database: https://github.com/advisories/GHSA-q855-8rh5-jfgq (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/07/ghsa-q855-8rh5-jfgq-ha-mcp (opens external site)
Did this work for you?- Check your version: run