Cloudanix VulnDB

GHSA-g39v-cvjh-8fpf

Medium · 6.5

Home Assistant MCP Server: YAML config backups written under www/ are served unauthenticated at /local/

CVSS

6.5

EPSS

—

Published

May 14, 2026

CISA due date

—

The record

When `ENABLE_YAML_CONFIG_EDITING=true`, every `ha_config_set_yaml` call backs up the pre-edit file to `<config>/www/yaml_backups/`, which Home Assistant serves at `/local/` with **no authentication**. Anyone who can reach the HA web interface can download the most recent pre-edit `configuration.yaml` (or other YAML file) — typically containing plaintext MQTT passwords, REST credentials, webhook IDs, geofence coordinates, and `shell_command` definitions — with zero credentials.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities