AI Threat AlertCVE-2026-53453: Blueprint Studio: broken authz grants full HA control
UNKNOWNBlueprint Studio, a browser-based configuration editor for Home Assistant, enforced its admin-only boundary only in the frontend — the backend never verified that callers of its API, upload, stream, terminal, and WebSocket routes actually held admin privileges. Any authenticated non-admin user of a shared Home Assistant instance could invoke arbitrary Home Assistant services, exfiltrate device and configuration state via render_template, rewrite configuration files with global_replace, upload files, and reach terminal helpers — amounting to full compromise of the automation platform's confidentiality, integrity, and availability. There is no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or scanner template yet, so this is not under active exploitation, but the barrier to exploitation is trivial once an attacker holds any authenticated non-admin account and knows the raw endpoint names. Patch to Blueprint Studio 2.5.2 immediately; until then, restrict the panel to admin-only accounts or disable it for any Home Assistant instance with shared/non-admin users, and audit logs for non-admin use of call_service, render_template, or global_replace.
What is the risk?
Low-to-moderate overall risk today: exploitation requires an existing authenticated (non-admin) account on the Home Assistant instance, there is no CVSS/EPSS score, no CISA KEV listing, and no public PoC or Nuclei template observed. However, once that authenticated foothold exists, exploitation is trivial (CWE-862, missing authorization checks on multiple backend routes) and the impact is severe — arbitrary service invocation, config tampering, and file/terminal access. Risk rises sharply for multi-user or managed deployments (families, tenants, property managers, MSPs running Home Assistant for clients) where non-admin accounts are common and Blueprint Studio is installed.
How does the attack unfold?
How severe is it?
What should I do?
1 step1) Upgrade Blueprint Studio to 2.5.2 or later immediately (fix commit referenced in GHSA-ppwq-ch6x-936g). 2) Until patched, restrict Blueprint Studio access to admin accounts only, or disable/uninstall the add-on for instances with any non-admin users. 3) Audit Home Assistant logs for non-admin accounts invoking call_service, render_template, or global_replace, or accessing terminal/upload/stream routes. 4) Review recent configuration file changes and uploaded files for unauthorized modifications following any suspected exposure window. 5) Apply least-privilege account design in Home Assistant — avoid granting shared/tenant/family accounts standing access unless required.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-53453?
Blueprint Studio, a browser-based configuration editor for Home Assistant, enforced its admin-only boundary only in the frontend — the backend never verified that callers of its API, upload, stream, terminal, and WebSocket routes actually held admin privileges. Any authenticated non-admin user of a shared Home Assistant instance could invoke arbitrary Home Assistant services, exfiltrate device and configuration state via render_template, rewrite configuration files with global_replace, upload files, and reach terminal helpers — amounting to full compromise of the automation platform's confidentiality, integrity, and availability. There is no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or scanner template yet, so this is not under active exploitation, but the barrier to exploitation is trivial once an attacker holds any authenticated non-admin account and knows the raw endpoint names. Patch to Blueprint Studio 2.5.2 immediately; until then, restrict the panel to admin-only accounts or disable it for any Home Assistant instance with shared/non-admin users, and audit logs for non-admin use of call_service, render_template, or global_replace.
Is CVE-2026-53453 actively exploited?
No confirmed active exploitation of CVE-2026-53453 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-53453?
1) Upgrade Blueprint Studio to 2.5.2 or later immediately (fix commit referenced in GHSA-ppwq-ch6x-936g). 2) Until patched, restrict Blueprint Studio access to admin accounts only, or disable/uninstall the add-on for instances with any non-admin users. 3) Audit Home Assistant logs for non-admin accounts invoking call_service, render_template, or global_replace, or accessing terminal/upload/stream routes. 4) Review recent configuration file changes and uploaded files for unauthorized modifications following any suspected exposure window. 5) Apply least-privilege account design in Home Assistant — avoid granting shared/tenant/family accounts standing access unless required.
What systems are affected by CVE-2026-53453?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, IoT/smart-home automation orchestration.
What is the CVSS score for CVE-2026-53453?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0053AI Agent Tool InvocationCompliance Controls Affected
What are the technical details?
Original Advisory
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization boundary. Affected surfaces included the backend API, upload API, stream routes, terminal WebSocket, Blueprint Studio WebSocket subscriptions, call_service, render_template, global_replace, file and stream access paths, upload handling, and terminal helpers. A non-admin user could invoke arbitrary Home Assistant services, expose Home Assistant state through templates, modify configuration files, access streamed or downloaded configuration content, upload files, or reach terminal-related helpers. These actions could compromise the confidentiality, integrity, and availability of the Home Assistant installation. This issue is fixed in version 2.5.2.
Exploitation Scenario
A non-admin Home Assistant user (e.g., a family member, tenant, or employee in a managed building) has legitimate but limited login access. The Blueprint Studio UI hides admin-only actions from them, but because the backend never re-checks authorization, they open browser devtools or write a short script to call the same API/WebSocket endpoints directly — e.g., call_service to unlock a smart lock or disable an alarm, render_template to dump sensitive state and secrets, or global_replace to silently rewrite automation configuration for persistence. No exploit tooling or deep AI/ML expertise is required — just knowledge of the exposed route names, which are documented in the GitHub advisory itself.
Weaknesses (CWE)
CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
- [Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- [Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2025-512010.0smolagents: sandbox escape enables unauthenticated RCE
Same attack type: Code ExecutionCVE-2025-5952810.0Flowise: Unauthenticated RCE via MCP config injection
Same attack type: Code ExecutionCVE-2025-282810.0LangChain RequestsToolkit: SSRF exposes cloud metadata
Same attack type: Auth BypassCVE-2025-5376710.0Azure OpenAI: SSRF EoP, no auth required (CVSS 10)
Same attack type: Privacy ViolationCVE-2024-291210.0BentoML: RCE via insecure deserialization (CVSS 10)
Same attack type: Code Execution