core
2026.11.1:house_with_garden: Open source home automation that puts local control and privacy first.
- Maintenance
- Active10331 commits in 3 months · bus factor 7
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 26 advisories5 critical, 11 high, 6 medium, 4 low · Scorecard 8.4/10
- Supported versions
- No scheduleendoflife.date does not track this project
92.3k stars · 39.3k forks · 4k open issues · last release 5 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 26 most recent advisories published by the maintainers: 5 critical, 11 high, 6 medium, 4 low. Check the patched version against the one you run.
- mediumCVE-2026-91131Oct 29, 2026SSRF in Service Discovery Protocol service (SSDP)
- Affected
- < 2026.8.0
- Patched in
- 2026.8.0
- mediumCVE-2026-91129Sep 16, 2026mDNS Server-Side Request Forgery
- Affected
- < 2026.2.2
- Patched in
- 2026.2.3
- highCVE-2026-91130Sep 16, 2026XSS in Statistics Graph Card
- Affected
- 2025.1.4<
- Patched in
- >2026.06
- highCVE-2026-66061Jul 31, 2026Companion app (iOS) forwards NFC/QR tag scans to Home Assistant without user confirmation, allowing silent automation execution by untrusted callers
- Affected
- <2026.5.0
- Patched in
- 2026.5.0
- highCVE-2026-66060Jul 31, 2026Companion app (Android) forwards NFC/QR tag scans to Home Assistant without user confirmation, allowing silent automation execution by untrusted callers
- Affected
- <2026.5.3
- Patched in
- 2026.5.3
- mediumCVE-2026-59717Jul 26, 2026Home Assistant Companion (Android) `homeassistant://invite` Deep Link Credential Phishing
- Affected
- < 2026.6.1
- Patched in
- 2026.6.1
- highCVE-2026-55844Jun 25, 2026iOS Companion App 2023.471 ignores internal SSID allowlist for connections – possible leak of access token and sensor data
- Affected
- 2023.471
- Patched in
- 2025.5.0
- highCVE-2026-54317Jun 18, 2026Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
- Affected
- < 2026.6.0
- Patched in
- 2026.6.0
- highCVE-2026-54318Jun 17, 2026Exported BroadcastReceiver allows local apps to spoof device location
- Affected
- ≤ 2026.5.2
- Patched in
- 2026.5.3
- highCVE-2026-44698May 11, 2026Cross-origin iframe access token exfiltration via WebView JS bridge callback injection
- Affected
- <2026.4.1; <2026.4.4
- Patched in
- 2026.4.1; 2026.4.4
- mediumCVE-2026-33044Mar 27, 2026Stored XSS in Map-card through malicious device name
- Affected
- 2020.02 to 2026.01
- Patched in
- 2026.01
- mediumCVE-2026-33045Mar 27, 2026Stored XSS in history-graphs
- Affected
- 2025.02 to 2026.01
- Patched in
- 2026.01
- criticalCVE-2026-34205Mar 27, 2026Unauthenticated app (add-on) endpoints exposed to local network via host network mode
- Affected
- <= 17.1; <= 2026.03.1
- Patched in
- N/A; 2026.03.2
- highCVE-2025-62172Oct 14, 2025Stored XSS in graph tooltip from entity name
- Affected
- 2025.1.0 to 2025.10.1
- Patched in
- 2025.10.2 and newer
- highCVE-2025-25305Feb 18, 2025SSL validation for outgoing requests in core and used libs not correct
- Affected
- < 2024.1.6
- Patched in
- 2024.1.6
- mediumCVE-2023-50715Dec 14, 2023User accounts disclosed to unauthenticated actors on the LAN
- Affected
- < 2023.12.2
- Patched in
- 2023.12.3
- highCVE-2023-44385Oct 19, 2023Client-Side Request Forgery in iOS/macOS native Apps
- Affected
- < 2023.7
- Patched in
- 2023.7
- lowCVE-2023-41899Oct 19, 2023Partial Server-Side Request Forgery in Core
- Affected
- < 2023.9.0
- Patched in
- 2023.9.0
- highCVE-2023-41898Oct 19, 2023Arbitrary URL load in Android WebView in `MyActivity.kt`
- Affected
- < 2023.9.2
- Patched in
- 2023.9.2
- lowGHSA-jff5-5j3g-vhqcOct 19, 2023Actions expression injection in `helpers/version/action.yml`
- Affected
- < September 5, 2023
- Patched in
- September 5, 2023
- criticalCVE-2023-41897Oct 19, 2023Lack of XFO header allows clickjacking
- Affected
- < 2023.9.0
- Patched in
- 2023.9.0
- criticalCVE-2023-41896Oct 19, 2023Fake WS server installation permits full takeover
- Affected
- < 2023.8.0; < 8.2.0
- Patched in
- 2023.8.0; 8.2.0
- lowCVE-2023-41894Oct 19, 2023Local-only webhooks externally accessible via SniTun
- Affected
- < 2023.9.0
- Patched in
- 2023.9.0
- criticalCVE-2023-41895Oct 19, 2023Full takeover via javascript URI in auth_callback login
- Affected
- < 2023.9.0
- Patched in
- 2023.9.0
- lowCVE-2023-41893Oct 19, 2023Account takeover via auth_callback login
- Affected
- < 2023.9.0
- Patched in
- 2023.9.0
- criticalCVE-2023-27482Mar 8, 2023Authentication bypass Supervisor API
- Affected
- <2023.03.3; <2023.3.2
- Patched in
- 2023.03.3; 2023.3.2