PT-2026-42987 · Pypi · Ha-Mcp

Published

2026-05-14

·

Updated

2026-05-14

CVSS v3.1

6.5

Medium

VectorAV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

When ENABLE YAML CONFIG EDITING=true, every ha config set yaml call backs up the pre-edit file to <config>/www/yaml backups/, which Home Assistant serves at /local/ with no authentication. Anyone who can reach the HA web interface can download the most recent pre-edit configuration.yaml (or other YAML file) — typically containing plaintext MQTT passwords, REST credentials, webhook IDs, geofence coordinates, and shell command definitions — with zero credentials.

Details

The backup feature is good — do backup defaults to True and protects users from a bad edit. The issue is the location:
  • custom components/ha mcp tools/ init .py:596 — backup dir = config dir / "www" / "yaml backups"
  • custom components/ha mcp tools/ init .py:602 — backup file = backup dir / f"{safe name}.{timestamp}.bak"
  • custom components/ha mcp tools/ init .py:606-607,692-693 — backup path returned to caller and logged at INFO
<config>/www/ is /local/ and HA serves it unauthenticated by design (intended for static dashboard assets). An attacker discovers the path three ways: (1) it's returned to the MCP client in result["backup path"]; (2) it's logged at INFO and recoverable via ha get logs; (3) the timestamp format is %Y%m%d %H%M%S — 86,400 candidates per day, enumerable. Backups accumulate (no rotation), so a long-running install holds a chronological history.
Preconditions: ENABLE YAML CONFIG EDITING=true (off by default), at least one YAML edit made, and the attacker can reach HA's port 8123 (LAN, or internet via Nabu Casa / reverse proxy).

PoC

A pytest E2E test against a fresh Docker HA container with the custom component installed (using the project's existing ha container with fresh config fixture):
[1] ha config set yaml(yaml path="template", action="add", ...) → success=True
[1] backup path = 'www/yaml backups/configuration.yaml.20260505 171335.bak'
[2] GET http://<ha>:8123/local/yaml backups/configuration.yaml.20260505 171335.bak
  (no Authorization header)
[2] HTTP 200, 440 bytes — the full pre-edit configuration.yaml
[control] GET /api/config without auth → HTTP 401
The control proves the result is meaningful: the same instance returns 401 for an authenticated endpoint; only /local/ is unauthenticated by HA design.

Impact

CWE-552 (Files or Directories Accessible to External Parties). Affects users with ENABLE YAML CONFIG EDITING=true who have made at least one YAML edit. Anyone who can reach HA port 8123 reads the most recent pre-edit config without credentials. CVSS 6.5 medium (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); 7.5 high if HA is internet-exposed.

Resolution

Fixed in 7.4.1.dev456 (PR #1180). The fix relocates new backups to <config>/.ha mcp tools backups/ (config root, not served by /local/) and adds a one-time migration on integration setup that moves any pre-existing exposed backups, surfaces a persistent notification telling the user to rotate exposed secrets, and removes the legacy directory if empty.
The fix ships in the next biweekly stable release and is available immediately on the dev channel. Updating to a release containing the fix is sufficient — no manual action required for users who upgrade.

Manual cleanup (for users who cannot upgrade yet)

If you used ha config set yaml on a vulnerable version and cannot wait for the next stable release, manually remove the exposed backups:
rm -rf <config>/www/yaml backups/
Then rotate any secrets that may have been in the YAML files those backups captured (MQTT/REST credentials, webhook IDs, shell command definitions, geofence coordinates). The directory is reachable at http(s)://<ha-host>:8123/local/yaml backups/ until removed. After the next addon/package upgrade containing the fix, the integration will run this cleanup automatically and surface a persistent notification with the same rotation guidance.

Fix

Files Accessible to External Parties

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-552

Related Identifiers

GHSA-G39V-CVJH-8FPF

Affected Products

Ha-Mcp