CVE-2026-54317: Home Assistant Konnected Authentication Bypass – Unauthorized Sensor Data Access

Technical summary

The Konnected integration in Home Assistant registers an HTTP endpoint (KonnectedView) with requires_auth = False, relying instead on token-based authentication documented in comments. However, the implementation is inconsistent: the update_sensor() method properly validates Authorization: Bearer tokens using hmac.compare_digest() for write operations, but the get() method handling read requests contains no authentication logic whatsoever. This leaves sensor state, device configuration, and other operational data accessible to any network-adjacent attacker without credentials.

Business impact

An attacker on the same network as a Home Assistant installation can passively reconnaissance the home automation setup, observe real-time sensor states (doors, windows, motion detectors), and infer occupancy and security posture without authentication. While write access is blocked, read-only access to this intelligence can enable physical intrusion planning, theft, or stalking. Home automation enthusiasts and small businesses relying on Home Assistant for security monitoring are most affected.

Affected systems

Home Assistant versions prior to 2026.6.0 with the Konnected integration enabled are affected. The Konnected integration is an optional add-on used to bridge Konnected security hardware with Home Assistant. Any deployment that has installed and configured this integration is vulnerable to unauthorized read access on the local network segment.

Exploitability

Exploitability is straightforward for attackers with network access to the Home Assistant instance. No authentication is required, no user interaction is needed, and the attack is unthrottled—an attacker can simply send HTTP GET requests to the endpoint to retrieve all exposed data. The attack surface is limited to the local network (CVSS AV:A), but within that boundary, the barrier to exploitation is minimal. No special tools or knowledge are required beyond HTTP client capabilities.

Remediation

Upgrade Home Assistant to version 2026.6.0 or later, which implements proper authentication checks for all HTTP methods on the Konnected endpoint. If immediate patching is not feasible, disable or uninstall the Konnected integration until the patch can be applied, or restrict network access to the Home Assistant instance via firewall rules to trusted devices only.

Patch guidance

Home Assistant users should update to version 2026.6.0, which fixes the authentication bypass by enforcing token validation on GET requests as well as write operations. Verify the patch is applied by checking the Home Assistant version in Settings > About and confirming the version is 2026.6.0 or later. If you are using automatic updates, this patch should be deployed automatically on the next update cycle.

Detection guidance

Monitor Home Assistant logs for unexpected GET requests to the Konnected endpoint at paths like /api/konnected or similar. Network intrusion detection can flag repeated unauthenticated HTTP GET requests to the Konnected integration endpoint from unexpected source IPs. On the Home Assistant host, inspect network traffic for unencrypted HTTP GET requests with missing or invalid Authorization headers targeting the Konnected integration URL. If possible, enable verbose logging on the Konnected integration to capture all endpoint accesses and review for anomalies.

Why prioritize this

This vulnerability merits immediate attention because it is easy to exploit (no authentication required), affects a sensitive security-adjacent system (home automation with door/window/motion sensors), and the CVSS score of 7.6 reflects high confidentiality impact with some integrity and availability risk. Although network proximity is required (AV:A), many home networks are shared by family members, guests, or IoT devices that may be compromised. Home Assistant often manages security-critical devices, making unauthorized read access a meaningful risk.

Risk score, explained

The CVSS 3.1 score of 7.6 (HIGH) reflects the high confidentiality impact of reading sensor data and device state without authentication (C:H), combined with low integrity and availability impact (I:L, A:L). The attack vector is adjacent (AV:A) since it requires network proximity, and the attack complexity is low (AC:L) because no special conditions are needed. The lack of privilege or user interaction requirements (PR:N, UI:N) further elevates the score. The unscoped impact (S:U) means the attacker gains access only within the integration, not the broader system.

Frequently asked questions