{"id":"GHSA-q855-8rh5-jfgq","summary":"ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path","details":"### Summary\n\nIn add-on mode, the ha-mcp settings UI routes are mounted both under the MCP secret path **and** at the bare root of the published port (`:9583`), so Home Assistant ingress can serve the \"Open Web UI\" button. The root-mounted routes perform no authentication — no secret, no `Origin` check, no CSRF token — so any client that can reach `:9583` without the MCP secret can invoke them.\n\n### Affected configurations\n\nHome Assistant **add-on** installations (`host_network: true` with port `9583` published), v7.6.0 and earlier. Docker and standalone installs are **not** affected — there the settings routes are mounted only under the secret path.\n\nRoot-mounted routes in affected versions: tool visibility (`/api/settings/tools` GET/POST), feature flags (`/api/settings/features` GET/POST), the auto-backup suite (`/api/settings/backups…` incl. restore/delete, and `/api/settings/backup-config`), add-on restart (`/api/settings/restart`), and — when the opt-in Tool Security Policies feature is enabled — the approval-policy API (`/api/policy/config` GET/PUT, `/api/policy/approve`, `/api/policy/deny`, …).\n\n### Impact\n\nWithout authentication, a caller that reaches `:9583` — a peer on the local network, a reverse proxy/tunnel that forwards the bare root path (e.g. a whole-host Cloudflared config), or a CSRF `POST` from a page open in a LAN browser — can read or change which MCP tools are exposed, toggle feature flags, list/view/restore/delete backups, restart the add-on, and (with Tool Security Policies enabled) read and rewrite the approval policy, disabling the human-approval gate on gated tools.\n\nThere is **no** access to Home Assistant data, entities, or credentials, and no code execution. All effects are confined to the add-on's own configuration and lifecycle and are recoverable. The primary (same-LAN) vector is within the add-on's documented trusted-network model; remote reachability requires the operator to have reverse-proxied the bare port.\n\n### Proof of concept\n\nWith the add-on running and reachable on `:9583`, from any host that can reach the port without the secret:\n\n```\nGET  /api/settings/tools                 -\u003e 200   (read tool config, no auth)\nPOST /api/settings/tools  {\"states\":{}}  -\u003e 200   (rewrite tool config, no auth / no CSRF token)\nPOST /api/settings/restart               -\u003e 200   (restart the add-on)\n```\n\nThe MCP endpoint itself remains correctly protected by the secret path.\n\n### Patch\n\nFixed in PR homeassistant-ai/ha-mcp#1508 (merged to `master`): the root-mounted add-on routes are restricted to Home Assistant ingress, which always originates from the Supervisor (`172.30.32.2`); every other caller receives `403`. Direct and remote access continue to use the settings UI under the MCP secret path (`…/\u003csecret\u003e/settings`), so the \"Open Web UI\" button, Cloudflared, and the Webhook Proxy add-on are unaffected.\n\nThe fix will ship in the next stable add-on release. If you'd rather have it now, it is already on the dev channel (add-on dev build ` 7.6.0.dev393` or later) — optional; there's no need to switch channels just for this, it is a fairly low risk surface and only exposes the web UI for addon mode only.\n\n### Severity\n\n`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L` = 6.4 (Moderate). Confidentiality impact is None — tool config and backups are not secrets or credentials; integrity and availability impacts are Low — configuration changes and an add-on restart are recoverable.\n\n### Credit\n\nReported by @bharat.","modified":"2026-07-07T23:45:17.423743490Z","published":"2026-07-07T23:41:21Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-306","CWE-352"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-07-07T23:41:21Z"},"references":[{"type":"WEB","url":"https://github.com/homeassistant-ai/ha-mcp/security/advisories/GHSA-q855-8rh5-jfgq"},{"type":"WEB","url":"https://github.com/homeassistant-ai/ha-mcp/pull/1508"},{"type":"WEB","url":"https://github.com/homeassistant-ai/ha-mcp/commit/9f5b085ad4a7b38b067c9da0dc5b45462c4d796e"},{"type":"PACKAGE","url":"https://github.com/homeassistant-ai/ha-mcp"}],"affected":[{"package":{"name":"ha-mcp","ecosystem":"PyPI","purl":"pkg:pypi/ha-mcp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.10.0"}]}],"versions":["3.3.0","3.3.1","3.3.2","3.4.0","3.4.2","3.4.3","3.5.0","3.5.1","3.6.0","3.6.1","3.6.2","3.7.0","4.0.0","4.0.1","4.1.0","4.10.0","4.11.0","4.11.1","4.11.2","4.11.3","4.11.4","4.11.5","4.11.6","4.11.7","4.11.8","4.11.9","4.12.0","4.13.0","4.14.0","4.14.1","4.14.2","4.15.0","4.15.1","4.16.0","4.16.1","4.16.2","4.17.0","4.17.1","4.18.0","4.18.1","4.18.2","4.19.0","4.2.0","4.20.0","4.21.0","4.22.0","4.22.1","4.3.0","4.4.0","4.5.0","4.6.0","4.7.0","4.7.1","4.7.2","4.7.3","4.7.4","4.7.5","4.7.6","4.7.7","4.8.0","4.8.1","4.8.2","4.8.3","4.8.4","4.8.5","4.9.0","5.0.0","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.1.0","6.0.0","6.1.0","6.2.0","6.3.0","6.3.1","6.4.0","6.5.0","6.6.0","6.6.1","6.7.0","6.7.1","6.7.2","7.0.0","7.1.0","7.2.0","7.3.0","7.4.0","7.5.0","7.6.0","7.7.0","7.8.0","7.8.1","7.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-q855-8rh5-jfgq/GHSA-q855-8rh5-jfgq.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}]}