CVE-2026-91129

## Summary Home Assistant Green is vulnerable to a Server-Side Request Forgery (SSRF) via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal services bound to localhost. The IPP integration automatically processes `_ipp._tcp.local` service announcements without any user interaction or authentication, and follows HTTP redirects from the attacker-controlled host. ## Details Home Assistant listens for mDNS service announcements on port 5353. When a service of type `_ipp._tcp.local` is discovered, the IPP integration's zeroconf handler (`homeassistant/components/ipp/config_flow.py`) processes it automatically. The `async_step_zeroconf` method extracts `host`, `port`, and `base_path` directly from the mDNS discovery info without validation: ```python async def async_step_zeroconf( self, discovery_info: ZeroconfServiceInfo ) -> ConfigFlowResult: host = discovery_info.host port = discovery_info.port zctype = discovery_info.type name = discovery_info.name.replace(f".{zctype}", "") tls = zctype == "_ipps._tcp.local." base_path = discovery_info.properties.get("rp", "ipp/print") self.discovery_info.update( { CONF_HOST: host, CONF_PORT: port, CONF_SSL: tls, CONF_VERIFY_SSL: False, CONF_BASE_PATH: f"/{base_path}", CONF_NAME: name, CONF_UUID: unique_id, } ) ``` These values are then passed to `validate_input()`, which constructs an HTTP request (IPP over HTTP) to the attacker-controlled host: ```python async def validate_input(hass: HomeAssistant, data: dict) -> dict[str, Any]: session = async_get_clientsession(hass) ipp = IPP( host=data[CONF_HOST], port=data[CONF_PORT], base_path=data[CONF_BASE_PATH], tls=data[CONF_SSL], verify_ssl=data[C