Home Assistant Green: Root RCE via Localhost Exploit Disclosed…

ZDI-26-561 reveals a command injection in the Home Assistant Green go2rtc process. The flaw allows arbitrary code execution as root for anyone with access to the device's localhost interface.

Editor's note on source limitations: This analysis is based solely on the ZDI-26-561 advisory, the only structured primary source available. No independent source has corroborated the technical details. The CVE ID, CVSS, and vendorPatchUrl fields are empty in the advisory; the affectedVendor field contains a parsing error (a date instead of a vendor name).

On August 12, 2026, the ZDI-26-561 advisory disclosed a vulnerability in the Home Assistant Green go2rtc process that allows arbitrary code execution with root privileges. The attack condition — a network-adjacent attacker gaining access to the device's localhost interface — opens a front that security teams often overlook.

Key Takeaways

Vulnerability ZDI-26-561 affects the Home Assistant Green go2rtc process and allows command injection with code execution as root
The attacker must be network-adjacent and have obtained access to the device's localhost interface
The flaw stems from the lack of validation of a user-supplied string before it is passed to a system call
No CVE assigned, no CVSS score published, and no vendor-specific patch URL are available in the advisory

The Facts: How the Command Injection Works in go2rtc

The go2rtc process handles video streaming in RTSP and WebRTC formats within Home Assistant Green. According to the ZDI-26-561 advisory, the vulnerability lies in the lack of validation of a user-supplied string before it is used to execute a system call.

This command injection mechanism allows the attacker to inject arbitrary commands that are executed in the context of root. The advisory does not specify which go2rtc parameters are injectable nor provide details on the attack payload.

"This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Home Assistant Green. An attacker must first obtain the ability to access the device's localhost interface." — ZDI Advisory ZDI-26-561

"The specific flaw exists within the go2rtc process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root." — ZDI Advisory ZDI-26-561

Analysis: Why the "Localhost" Prerequisite Is Not a Barrier

Editorial analysis section — the following data is not in the brief:

The ZDI-26-561 advisory describes the attacker as "network-adjacent" with the ability to access the localhost interface. The term "network-adjacent" indicates network proximity: the attacker is on the same local network or in a position to reach the device without traversing public internet perimeters.

The brief does not specify whether localhost access requires prior compromise of other devices. In theory, a network-adjacent attacker could obtain access to the localhost interface through vectors not detailed in the advisory. This possibility remains hypothetical: the dossier does not document specific attack vectors beyond the localhost access prerequisite.

The brief does not document whether the vulnerability was actually exploited during the Pwn2Own 2026 edition, nor by which research team. The "(Pwn2Own)" reference in the advisory title indicates association with the ZDI program linked to the event, not necessarily a demonstration in competition.

What Is Missing from the Dossier: CVE, CVSS, and Patch

The ZDI-26-561 advisory presents empty fields for CVE ID, CVSS score, and scoring vector. The vendorPatchUrl field points to the ZDI advisory itself rather than a vendor patch resource.

The affectedVendor field, anomalously, contains the coordinated release date ("2026-08-12") rather than the vendor name. The vendor inferred from the advisory context is Nabu Casa/Home Assistant, but this name does not appear in the structured affectedVendor field, indicating a parsing error in the ZDI data.

For security teams, these material gaps complicate risk management. Without a CVE, automatic correlation in vulnerability management systems is impossible. Without CVSS, there is no standardized framework for prioritization. Without a specific patch URL, the vendor's remediation status cannot be verified.

The brief does not document specific versions of Home Assistant Green or the go2rtc component affected. This limitation prevents users from quickly determining whether their installations fall within the risk perimeter.

What Changes

Given the absence of verifiable information on patches, mitigations, or fixed versions, it is not possible to formulate specific operational recommendations. The brief does not list technical countermeasures documented by the vendor or the researcher.

Operators managing Home Assistant Green installations must consider that:

The ZDI-26-561 advisory is the only structured source available on this vulnerability
No information is available regarding the availability of corrective updates
The vendorPatchUrl provided does not lead to a vendor patch but to the ZDI-26-561 advisory itself

The timeline reveals a gap of approximately 9 months between the vendor notification on November 5, 2025, and the coordinated advisory release on August 12, 2026. This window falls within standard coordinated disclosure practices, but leaves the device potentially exposed for a significant period without public information.

Open Questions and Limitations

Was the vulnerability actually demonstrated at Pwn2Own?: The advisory title includes the "(Pwn2Own)" reference but the brief does not document whether the exploit was actually executed during the competition or if the vulnerability was simply cataloged in the ZDI program associated with the event.
Which versions are affected?: The brief does not specify versions of Home Assistant Green, firmware versions, or go2rtc component versions. This limitation prevents users from quickly determining whether their installations fall within the risk perimeter.
What is the patch status?: No information is available in the advisory regarding the availability of corrective updates. The vendorPatchUrl duplicates the ZDI-26-561 advisory address.
How is localhost access obtained?: The brief does not specify whether localhost access requires prior compromise of other systems or what conditions make it possible. The dossier does not document pivoting or escalation vectors from network-adjacent to localhost access.

Source limitation: This article is based exclusively on the ZDI-26-561 advisory published by Zero Day Initiative. No independent source has verified the technical details. The advisory's structured fields present anomalies (affectedVendor containing a date, circular vendorPatchUrl, empty CVE and CVSS fields) that limit the completeness of the analysis.

Information is based on the cited source and current as of publication.

Sources

Sources and references