CVE-2026-54317

Name of the Vulnerable Software and Affected Versions Home Assistant versions prior to 2026.6.0

Description The Konnected integration registers an HTTP endpoint 'KonnectedView' (located in homeassistant/components/konnected/ init .py) that is configured to not require authentication. While write requests (POST and PUT) are processed by the update sensor() function and correctly validate the Authorization: Bearer <token> header, read requests (GET) are handled by a separate get() method that lacks any authentication checks. This allows unauthenticated read access to the endpoint.

Recommendations Update to version 2026.6.0.