Detections
Analytics

SCA: security update for ha-mcp (GHSA-fmfg-9g7c-3vq7)

medium Tenable Self-Hosted Container Security Plugin ID 438712

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form (beta feature)
 accepts a user-supplied ha_url and makes a server-side HTTP request to {ha_url}/api/config with no URL
 validation. An unauthenticated attacker can submit arbitrary URLs to perform internal network
 reconnaissance via an error oracle. Two additional code paths in OAuth tool calls (REST and WebSocket) are
 affected by the same primitive. The primary deployment method (private URL with pre-configured
 HOMEASSISTANT_TOKEN) is not affected. This vulnerability is fixed in 7.0.0. (CVE-2026-32111)

Solution

Update the ha-mcp library and its related packages to version 7.0.0 or later.

See Also

https://github.com/advisories/GHSA-fmfg-9g7c-3vq7

Plugin Details

Severity: Medium

ID: 438712

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 3/12/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-32111

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/12/2026

Vulnerability Publication Date: 3/11/2026

Reference Information

CVE: CVE-2026-32111

cwe: CWE-918