Home Assistant MCP Server: YAML config backups written under www/ are served unauthenticated at /local/
Date: 2026-05
Affected: pip/ha-mcp
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-552
CVSS: 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

### Summary When `ENABLE_YAML_CONFIG_EDITING=true`, every `ha_config_set_yaml` call backs up the pre-edit file to `<config>/www/yaml_backups/`, which Home Assistant serves at `/local/` with **no authentication**. Anyone who can reach the HA web interface can download the most recent pre-edit `configuration.yaml` (or other YAML file) — typically containing plaintext MQTT passwords, REST credentials, webhook IDs, geofence coordinates, and `shell_command` definitions — with zero credentials. ### Details The backup feature is good — `do_backup` defaults to `True` and protects users from a bad edit. The issue is the location: - `custom_components/ha_mcp_tools/__init__.py:596` — `backup_dir = config_dir / "www" / "yaml_backups"` - `custom_components/ha_mcp_tools/__init__.py:602` — `backup_file = backup_dir / f"{safe_name}.{timestamp}.bak"` - `custom_components/ha_mcp_tools/__init__.py:606-607,692-693` — backup path returned to caller and logged at INFO `<config>/www/` is `/local/` and HA serves it unauthenticated by design (intended for static dashboard assets). An attacker discovers the path three ways: (1) it's returned to the MCP client in `result["backup_path"]`; (2) it's logged at INFO and recoverable via `ha_get_logs`; (3) the timestamp format is `%Y%m%d_%H%M%S` — 86,400 candidates per day, enumerable. Backups accumulate (no rotation), so a long-running install holds a chronological history. **Preconditions:** `ENABLE_YAML_CONFIG_EDITING=true` (off by default), at least


Mitigations:

Architectural layers (MAESTRO):