5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32111

CVE-2026-32111: ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle

ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form (beta feature) accepts a user-supplied ha_url and makes a server-side HTTP request to {ha_url}/api/config with no URL validation. An unauthenticated attacker can submit arbitrary URLs to perform internal network reconnaissance via an error oracle. Two additional code paths in OAuth tool calls (REST and WebSocket) are affected by the same primitive. The primary deployment method (private URL with pre-configured HOMEASSISTANT_TOKEN) is not affected. This vulnerability is fixed in 7.0.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32111

CVE-2026-32111:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ha-mcp	pip	< 7.0.0	7.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security advisory and the associated patch commit dc8eaa16a8550f885614655f14b6fd9fe429b278 confirms the presence of a Server-Side Request Forgery (SSRF) vulnerability. The root cause is the lack of validation of the user-supplied ha_url parameter in the OAuth consent flow.

The primary vulnerable function was HomeAssistantOAuthProvider._validate_ha_credentials in src/ha_mcp/auth/provider.py, which made a direct HTTP request to the provided URL. This function was called by HomeAssistantOAuthProvider._consent_post after a user submitted the consent form. The patch completely removes the _validate_ha_credentials function and the ha_url input field from the consent form, now requiring the Home Assistant URL to be configured on the server-side.

Additionally, the vulnerability could be triggered in REST and WebSocket tool calls by using a forged OAuth token containing a malicious ha_url. The OAuthProxyClient._get_oauth_client function in src/ha_mcp/__main__.py was responsible for creating API clients using this user-controlled URL. The patch mitigates this by using the server-configured URL instead of the one from the token claims. The function create_consent_html is also identified as it was responsible for rendering the vulnerable input field.

Vulnerable functions

HomeAssistantOAuthProvider._validate_ha_credentials

src/ha_mcp/auth/provider.py

This function receives a user-controlled `ha_url` and makes an HTTP GET request to it without any validation. This allows an attacker to perform server-side request forgery (SSRF) attacks to scan the internal network and interact with internal services.

HomeAssistantOAuthProvider._consent_post

src/ha_mcp/auth/provider.py

This function processes the submitted OAuth consent form. It retrieves the user-supplied `ha_url` and passes it to the `_validate_ha_credentials` function, which contains the SSRF vulnerability. This function is a key part of the exploitation path for the consent form SSRF.

OAuthProxyClient._get_oauth_client

src/ha_mcp/__main__.py

This function is used to get a `HomeAssistantClient` for making API calls. In the vulnerable version, it would extract the `ha_url` from the claims of a forged OAuth token. This allowed an attacker to specify an arbitrary URL, leading to SSRF when subsequent REST or WebSocket tool calls were made.

create_consent_html

src/ha_mcp/auth/consent_form.py

This function generates the HTML for the OAuth consent form. The vulnerable version of this function included an input field for the `ha_url`, which was the entry point for the user to supply a malicious URL for the SSRF attack. The patch also adds HTML escaping for other fields to prevent XSS.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.