CVE-2026-66060Patch

LOWCVSS 7.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue is fixed in version 2026.8.1.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Referenced assets1 URL

By indicator

https://www.valtersit.com/cve/CVE-2026-66060/

Full discourse1 post

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters46d
Patch
CVE-2026-66060 – High severity flaw in Home Assistant. Companion app executes NFC/QR tag automations without caller validation, letting malicious apps trigger actions. CVSS 7.1. Update to 2026.5.3+ immediately. #CVE #HomeAssistant #infosec https://www.valtersit.com/cve/CVE-2026-66060/ #infosec #cybersecurity #CVE #Linux #infosec #infosec #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu
Post summary
A high‑severity flaw in Home Assistant’s companion app enables malicious apps to trigger NFC/QR automations; users are urged to update to 2026.5.3+ to mitigate the issue.
0000069
1.0K followersView on X

Explore more

Back to dashboard