Critical Local Privilege Escalation in Home Assistant Green (CVE‑2026‑91131) Enables Container Escape
What It Is — The Zero Day Initiative advisory ZDI‑26‑896 (CVE‑2026‑91131) describes a local‑privilege‑escalation flaw in Home Assistant Green. The vulnerability stems from storing user account tokens in cleartext within the container image. An attacker who can run low‑privileged code inside the Home Assistant container can read those tokens, escape the container sandbox, and execute arbitrary commands as root. The flaw carries a CVSS v3.1 score of 8.8 (High) with a vector of AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Home Assistant has published a patched release and a security advisory (GHSA‑6456‑4qg9‑cqpj).
Affected Products — Home Assistant Green (all versions prior to the November 2026 patch).
Why It Matters for Trust & Control Assurance — Storing credentials in plaintext violates the control objective of protecting sensitive authentication data and enables unchecked privilege escalation. Verisq’s Access Controls capability helps organizations continuously verify that secret management and container isolation meet audit‑ready standards.
Recommended Actions
- Deploy the Home Assistant Green update that removes cleartext token storage.
- Verify that all stored secrets are encrypted at rest and that container runtimes enforce strict isolation.
- Conduct a privileged‑access review to ensure least‑privilege principles for any code executing inside containers.
- Document the remediation steps as evidence for audit or third‑party assessments.