ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path
- Product
- ha-mcp
- Affected
- ha-mcp < 7.10.0 (Home Assistant add-on installations v7.6.0 and earlier)
- Fixed in
- 7.10.0
Last verified against sources: October 26, 2026
Am I affected?
ha-mcp: affected ha-mcp < 7.10.0 (Home Assistant add-on installations v7.6.0 and earlier). Fixed in 7.10.0.
- Check your version: run
pip show ha-mcp. Versions < 7.10.0 of ha-mcp are affected. [1]
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "ha-mcp>=7.10.0"(first patched version 7.10.0). [1] - If you'd rather have the fix now, it is already on the dev channel (add-on dev build 7.6.0.dev393 or later). [1]
- Use the settings UI under the MCP secret path (
…/<secret>/settings) for direct and remote access. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- In add-on mode, the ha-mcp settings UI routes are mounted both under the MCP secret path and at the bare root of the published port (
:9583). [1] - The root-mounted routes perform no authentication — no secret, no
Origincheck, no CSRF token. [1] - Affected configurations are Home Assistant add-on installations (
host_network: truewith port9583published), v7.6.0 and earlier. [1] - The MCP endpoint itself remains correctly protected by the secret path. [1]
Impact
- A caller that reaches
:9583can read or change which MCP tools are exposed, toggle feature flags, list/view/restore/delete backups, restart the add-on, and (with Tool Security Policies enabled) read and rewrite the approval policy, disabling the human-approval gate on gated tools. [1] - There is **no** access to Home Assistant data, entities, or credentials, and no code execution. [1]
- All effects are confined to the add-on's own configuration and lifecycle and are recoverable. [1]
What was done
- The vulnerability is fixed in PR homeassistant-ai/ha-mcp#1508 (merged to
master). [1] - The root-mounted add-on routes are restricted to Home Assistant ingress, which always originates from the Supervisor (
172.30.32.2). [1] - Every other caller receives
403. [1] - The fix will ship in the next stable add-on release. [1]
Sources
- GHSA-q855-8rh5-jfgq — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path
Product: ha-mcp | Affected: ha-mcp < 7.10.0 (Home Assistant add-on installations v7.6.0 and earlier) | Fixed in: 7.10.0
Summary: In add-on mode, the ha-mcp settings UI routes are mounted both under the MCP secret path and at the bare root of the published port (`:9583`).
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/07/ghsa-q855-8rh5-jfgq-ha-mcpCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for ha-mcp
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.