CVE-2026-91131

Summary Home Assistant is vulnerable to a blind Server-Side Request Forgery SSRF via the SSDP integration. An unauthenticated attacker on the local network can send a crafted SSDP "NOTIFY" announcement with an attacker-controlled "LOCATION" header, causing Home Assistant to issue an HTTP request ...