{"action":"Upgrade ha-mcp to 7.10.0 or later.","affected":[{"fixed":"7.10.0","introduced":"0"}],"component":"ha-mcp","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["7.10.0"],"ghsa_id":"GHSA-q855-8rh5-jfgq","id":"tcs_01M5KFVM478ZSTE419WPKWZ850","modified_at":"2026-07-07T23:45:17.423743490Z","published_at":"2026-07-07T23:41:21Z","references":["https://osv.dev/vulnerability/GHSA-q855-8rh5-jfgq","https://github.com/homeassistant-ai/ha-mcp/security/advisories/GHSA-q855-8rh5-jfgq","https://github.com/homeassistant-ai/ha-mcp/pull/1508","https://github.com/homeassistant-ai/ha-mcp/commit/9f5b085ad4a7b38b067c9da0dc5b45462c4d796e","https://github.com/homeassistant-ai/ha-mcp"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-q855-8rh5-jfgq","url":"https://osv.dev/vulnerability/GHSA-q855-8rh5-jfgq"}],"summary":"ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path"}