New CVE-2026-1201 (platform vulnerability was fixed in Aug 2025)

[ktm625sxc]

I just got the notice about a new CVE against Hubitat. I am new to the forum and I have not seen much mentioned about CVE's.
CVE-2026-1201 if you search for it you will see the details.
Anyone else track CISA news?
thanks-

===========
An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control connected devices outside of their authorized scope via client-side request manipulation.

[StephenH]

Simple fix: Update to the current 2.4.3.177.

[ogiewon]

Please provide a link to this CVE. I cannot find it on the CISA site.

[thebearmay]

@ktm625sxc

CVE-2026-1201

According to NIST it doesn't exist:
https://nvd.nist.gov/vuln/detail/CVE-2026-1201

and a search of the Database for Hubitat comes back not found.

[marktheknife]

@ktm625sxc

CVE-2026-1201 if you search for it you will see the details

Are you sure about that?

[aaiyar]

@thebearmay

and a search of the Database for Hubitat comes back not found.

Was just about to post the same thing.

[jtp10181]

Hubitat posted about the issue a while ago, assuming it is the same thing since the version number impacted matches.

Security Issue in Hubitat Dashboards

We wanted to share a serious security concern that has been recently identified by one of our community users with the current design of the Hubitat Dashboard app. Aaron 'theHastyOne' Hasty of Ostrich Lab first reported the issue on Aug 15 at 6:38 PM. Here is a summary of the issue discovered: The current design of the Hubitat Dashboard app allows for broad privilege escalation and disclosure of devices connected to this smarthome hub. With a link to a single dashboard (even one with no devic…

@gopher.ny

Release 2.4.2.157 Available

Changes from 2.4.2.143

Security Fixes

• Fixed a dashboard privilege escalation vulnerability . Big thanks to Aaron 'theHastyOne' Hasty of Ostrich Lab (@Hasty1) for discovering and documenting the issue!

[thebearmay]

@ktm625sxc

An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control connected devices outside of their authorized scope via client-side request manipulation.

Verbiage used belongs to CWE-639 (CWE - CWE-639: Authorization Bypass Through User-Controlled Key (4.19.1)).

Looking further it appears that it was never issued a CVE, but it does appear in a research blog:
https://ostrichlab.io/research-blog/?post=hubitat_FA

(Which is what @jtp10181 is referencing above) and note the included timeline:

**Disclosure Timeline:**

Discovery: 2025-08-10

Reported to Vendor: 2025-08-12

Vendor Acknowledgment: 2025-08-16

Vendor Patch Release: 2025-08-28

[ktm625sxc]

I don't see the CVE either, but the news reporting is here (odd): cisa . gov news-events ics-advisories icsa-26-022-06
(I can't include links for some reason.)

[jtp10181]

You need to be in the owners group to post links. It is a spam bot deterrent.

@jtp10181

If you are new and need to post screenshots (or links), manually join the owners group:
-> Hub owners - Hubitat

[aaiyar]

FWIW, according to cve.org, the CVE id has been reserved by a CNA, but there is no corresponding CVE record ...

[gopher.ny]

This is legit, I've been communicating with a number of people at CERT Vulnerability Notes Database to acknowledge and to backfill the information. It's not public yet, as far as I can tell in VINCE.

The issue has been reported privately and is fixed in firmware build 2.4.2.157: Release 2.4.2 Available - #10 by gopher.ny.

In a nutshell, if you have a functioning link to a single dashboard, you can use some crafty ways to access other dashboards and to control devices that the original dashboard has no permissions to.

[thebearmay]

https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-06

Edit: I like the fact that the category effected is:

• Critical Infrastructure Sectors: Energy, Communications

[ktm625sxc]

On the topic of the CVE classification, I agree, I work in the energy generation industry and was surprised to find Hubitat listed in a group of other industrial control CVE's.

[danabw]

@ktm625sxc

...energy generation industry and was surprised to find Hubitat...

Things can get pretty hot around here when some new gadget comes out.

Thanks for the details, Victor!

[marktheknife]

More information available here:

Write up from last years security update

Hello, I am the security researcher who report the issue described in the notice here. A write up of what was found and how it could have been exploited is now available. https://ostrichlab.io/research-blog/?post=hubitat_writeup If you haven't updated to at least 2.4.2.157, please do so now! I do want to thanks @bobbyD and @gopher.ny for being quick and professional.

[Hasty1]

Yes. I did initially report this to MITRE but with the current funding issues and the holidays, it never got processes. I re-reported this to CISA and it has now been assigned CVE-2026-1201. The write-up on how this vulnerability functions is linked in a post in this thread as well.

I am happy to answer any questions and will again reiterate that @gopher.ny and @bobbyD were helpful and quick to resolve this issue.