VulnSocial

CVE-2026-27796Disclosure(homarr / homarr)

LOWCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthenticated users to retrieve a complete list of configured integrations. This metadata includes sensitive information such as internal service URLs, integration names, and service types. This issue has been patched in version 1.54.0.

homarr CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-200CWE-862

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • homarr

Threat summary

  • Public PoC is present in monitored signal
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 2 mentions (2026-03-07); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
homarr
Products
homarr

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-03-07: 2Mentions · 2026-08-14: 1PoC Mentioned / Linked · 2026-08-14: 1Technical Details · 2026-03-07: 2Technical Details · 2026-08-14: 103-0708-14
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-03-072
Disclosure2
2026-08-141
Disclosure1
Full discourse3 posts
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-27796 - medium 🚨 Homarr < 1.54.0 - Information Disclosure > Homarr < 1.54.0 contains an information disclosure caused by the integration.all tRPC... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-27796 @pdnuclei #NucleiTemplates #cve

    Post summary

    The post announces the medium‑severity information‑disclosure vulnerability CVE‑2026‑27796 in Homarr versions below 1.54.0, linking to a library page for further details.

    00011278
    1.2K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-27796 Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthenticated use… https://www.cve.org/CVERecord?id=CVE-2026-27796

    Post summary

    A brief advisory about Homarr's unauthenticated access to its tRPC integration endpoint before version 1.54.0.

    00000141
    56.6K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-27796 Unauthenticated Information Disclosure in Homarr Dashboard Before 1.54.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27796

    Post summary

    The text announces CVE‑2026‑27796 as an unauthenticated information disclosure flaw in Homarr Dashboard versions prior to 1.54.0, with a link to vulnerability details, but no PoC, exploit, or patch information provided.

    0000042
    4.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apphomarrhomarr---

Explore more

Back to dashboardhomarr CVEshomarr vulnerabilities