CVE-2026-66060

{
  "id": "CVE-2026-66060",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-07T21:17:29.520",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Home Assistant is open source home automation software focused on local control and privacy.  Prior to 2026.5.3,  the Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue is fixed in version 2026.8.1."
    },
    {
      "lang": "es",
      "value": "Home Assistant es un software de automatización del hogar de código abierto centrado en el control local y la privacidad. Antes de la versión 2026.5.3, la aplicación Companion trata los enlaces de etiquetas (NFC o QR) entregados a través de un mecanismo de enrutamiento a nivel del sistema operativo como si hubieran sido escaneados físicamente, sin validar la aplicación que realiza la llamada ni solicitar la confirmación del usuario. Como resultado, cualquier aplicación no confiable en el dispositivo puede reenviar una etiqueta arbitraria a Home Assistant, haciendo que ejecute la automatización asociada como si un usuario legítimo hubiera escaneado una etiqueta autorizada. Esto permite la ejecución silenciosa y desatendida de automatizaciones por parte de llamantes locales no confiables. Este problema está solucionado en la versión 2026.8.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "home-assistant",
          "product": "core",
          "versions": [
            {
              "version": "< 2026.5.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-13T17:54:30.493186Z",
          "id": "CVE-2026-66060",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/home-assistant/android/commit/968b49c58e4eba4d06371a3f6e73198ec6c8d4a7",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/home-assistant/core/security/advisories/GHSA-2xqv-hwrf-983f",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/home-assistant/core/security/advisories/GHSA-2xqv-hwrf-983f",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}