(Pwn2Own) Home Assistant Green Cleartext Storage of Credentials Local Privilege Escalation Vulnerability

November 6th, 2026
ZDI-26-896 ZDI-CAN-28461

CVE ID

CVE-2026-91131

CVSS Score

8.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected Vendors

Home Assistant

Affected Products

Green

Vulnerability Details

This vulnerability allows local attackers to escalate privileges on affected installations of Home Assistant Green. An attacker must first obtain the ability to execute low-privileged code within a container on the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of user account tokens. The issue results from storing sensitive information in plaintext. An attacker can leverage this vulnerability to escape the container and execute arbitrary code in the context of root.

Additional Details

Home Assistant has issued an update to correct this vulnerability. More details can be found at:
https://github.com/home-assistant/core/security/advisories/GHSA-6456-4qg9-cqpj

Disclosure Timeline

  • 2025-11-05 - Vulnerability reported to vendor
  • 2026-11-06 - Coordinated public release of advisory
  • 2026-11-06 - Advisory Updated

Credit

Team ANHTUD

Back to Advisories