homeassistant-ai/ha-mcp Security Advisories | GitStock

medium2026-07-07

ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path

GHSA-q855-8rh5-jfgq

medium2026-05-14

Home Assistant MCP Server: YAML config backups written under www/ are served unauthenticated at /local/

GHSA-g39v-cvjh-8fpf

medium2026-03-12

ha-mcp has XSS via Unescaped HTML in OAuth Consent Form

GHSA-pf93-j98v-25pv · CVE-2026-32112

medium2026-03-12

ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle

GHSA-fmfg-9g7c-3vq7 · CVE-2026-32111