CVE-2026-66060

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue is fixed in version 2026.8.1.

Published 07 Aug 2026, 21:17 UTC Last modified 07 Aug 2026, 21:17 UTC

7.1

CVSS 3.1 HIGH base score CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Attack profile

The conditions required to exploit this vulnerability and its potential impact.

Attack vector Local

Attack complexity Low

Privileges required None

User interaction None

Scope Changed

Confidentiality None

Integrity High

Availability None

Exploitability2.5

Impact4.0

Affected products

Product applicability statements supplied with the NVD record.

NVD has not published structured affected-product data for this record.

Weakness classification

CWE categories help security teams group the underlying software weakness.

CWECWE-862

Source references

External advisories, patches and technical reports attached to this CVE record.

NVD National Vulnerability Database recordnvd.nist.gov 01 Technical reference security-advisories@github.com 02 Technical reference security-advisories@github.com