Summary Home Assistant is vulnerable to a blind Server-Side Request Forgery (SSRF) via the SSDP integration. An unauthenticated attacker on the local network can send a crafted SSDP "NOTIFY" announcement with an attacker-controlled "LOCATION" header, causing Home Assistant to issue an HTTP request to that URL. The location filter rejected loopback addresses written as IP literals but not the "localhost" hostname, so the request could be directed at services bound to the loopback interface that are not otherwise reachable from the network. The SSDP integration processes announcements automatically, without any user interaction or authentication, and is enabled by default as part of "default_config". ## Details Home Assistant listens for SSDP announcements on UDP port 1900. When a "NOTIFY" announcement is received, the device description is fetched from the URL given in the "LOCATION" header. Before making that request, the location is checked by "is_valid_location" in the "async_upnp_client" library: "python def is_valid_location(location: str) -> bool: """Validate if this location is usable.""" return location.startswith("http") and not ( "://127.0.0.1" in location or "://[::1]" in location or "://169.254" in location ) " The check is a set of substring comparisons against literal addresses. It rejects "127.0.0.1", "[::1]" and the "169.254" link-local range, but it does not account for hostnames that resolve to a loopback address. A "LOCATION" value using "localhost" passes validation and is then resolved and fetched, reaching the same interface the literal checks were intended to protect. The attacker cannot read the response to the request, so this is a blind SSRF. The scheme, host, port, path and query string are all attacker-controlled. ## PoC ### Prerequisites * Attacker machine on the same local network as the Home Assistant instance ### Exploit Send an SSDP "NOTIFY" announcement to the target with the "LOCATION" header set to an attacker-chosen URL: "NOTIFY * HTTP/1.1 HOST: <HOME_ASSISTANT_IP>:1900 NTS: ssdp:alive NT: urn:schemas-upnp-org:device:InternetGatewayDevice:1 USN: uuid:89a5dcd6-c11a-4287-92db-e8f0143d7f5b AL: http://<ATTACKER_IP>:4444/foo?bar=qaz LOCATION: http://<ATTACKER_IP>:4444/foo?bar=qaz" Home Assistant issues an HTTP GET to the supplied URL, including the query string, which can be observed with a listener on the attacker's machine. Substituting a loopback target demonstrates the filter bypass. A "LOCATION" of "http://127.0.0.1:<port>/<path>" is rejected. A "LOCATION" of "http://localhost:<port>/<path>" is accepted and the request is made. ### Exploit Flow 1. The attacker sends an SSDP "NOTIFY" announcement to UDP port 1900 on the target 2. The "LOCATION" header carries a URL using the "localhost" hostname 3. The location filter finds no matching IP literal and accepts the value 4. Home Assistant resolves "localhost" and issues the HTTP request to the loopback interface 5. The request reaches a service that is not otherwise accessible from the network ## Impact An unauthenticated attacker on the same local network can cause Home Assistant to issue arbitrary HTTP GET requests, including to services bound to the loopback interface that are not otherwise reachable. Exploitation requires no user interaction, no authentication and no prior configuration, as SSDP announcements are processed automatically and the integration is enabled by default. The response is not returned to the attacker, which limits direct data disclosure. The primary risk is reaching internal services as a step towards a further vulnerability in one of them. Home Assistant fetches device descriptions from discovery announcements by design, and requests to other hosts on the local network are expected behaviour. The issue addressed here is specifically that the loopback restriction could be bypassed. ## Mitigations The reported issue was addressed in Home Assistant 2025.11.3, which added the "localhost" hostname to the rejected locations. The validation was strengthened further in Home Assistant 2026.8.0. It no longer matches against a list of address strings but parses the hostname out of the URL and checks the address itself, so loopback is rejected however it is written. ## Acknowledgements Discovered Trend Micro ZDI (ZDI-CAN-28279).