CVE-2026-27796 in Homarr
Summary
by MITRE • 03/07/2026
Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthenticated users to retrieve a complete list of configured integrations. This metadata includes sensitive information such as internal service URLs, integration names, and service types. This issue has been patched in version 1.54.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 03/12/2026
The vulnerability identified as CVE-2026-27796 affects Homarr, an open-source dashboard solution that serves as a centralized interface for managing various integrations and services. This particular flaw resides within the tRPC endpoint implementation, specifically the integration.all endpoint that was improperly configured to operate as a publicProcedure. The misconfiguration allowed any unauthenticated user with access to the Homarr interface to exploit this endpoint and obtain comprehensive metadata about all configured integrations within the system. This represents a significant security oversight in the application's access control mechanisms, as the endpoint was designed to be publicly accessible rather than restricted to authenticated users with appropriate privileges.
The technical flaw manifests through the exposure of sensitive metadata through the integration.all tRPC endpoint, which functions as a publicProcedure rather than requiring proper authentication or authorization checks. This misconfiguration enables attackers to retrieve detailed information including internal service URLs, integration names, and service types without any form of user authentication. The vulnerability directly violates fundamental security principles of least privilege and proper access control, as it provides unauthorized access to information that should only be available to authenticated administrators or authorized personnel. The exposure of internal service URLs creates additional attack surface by revealing network topology and service endpoints that could be targeted in subsequent exploitation phases.
The operational impact of this vulnerability extends beyond simple information disclosure, as it provides attackers with comprehensive mapping of the system's integration landscape. The leaked metadata includes internal service URLs that could be leveraged for further reconnaissance, potentially enabling attackers to identify vulnerable services, understand system architecture, or plan more sophisticated attacks. Integration names and service types reveal the technologies and protocols in use within the environment, which could be exploited to target known vulnerabilities in specific integration components. This information disclosure vulnerability creates opportunities for attackers to conduct targeted attacks against specific integration points, potentially leading to privilege escalation, data exfiltration, or system compromise. The vulnerability affects all versions prior to 1.54.0, indicating that a substantial number of installations may have been exposed to this risk.
The remediation for this vulnerability involves patching the Homarr application to version 1.54.0 or later, which implements proper authentication requirements for the integration.all tRPC endpoint. This fix ensures that only authenticated users with appropriate permissions can access the integration metadata, aligning with security best practices for API endpoint protection. Organizations should immediately upgrade to the patched version and review their access control configurations to ensure that similar vulnerabilities do not exist in other endpoints. The fix demonstrates the importance of proper API security implementation and access control enforcement, particularly for administrative endpoints that provide sensitive system information. This vulnerability aligns with CWE-284 (Improper Access Control) and represents a clear violation of the principle of least privilege. From an ATT&CK perspective, this issue enables adversary techniques related to reconnaissance and credential access, as the exposed information facilitates further attack planning and execution against the compromised system.