CVE-2026-27796: Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak)
Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthenticated users to retrieve a complete list of configured integrations. This metadata includes sensitive information such as internal service URLs, integration names, and service types. This issue has been patched in version 1.54.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27796?
CVE-2026-27796 is classified as a medium-severity vulnerability due to its potential for information disclosure without authentication.
How do I fix CVE-2026-27796?
To fix CVE-2026-27796, upgrade Homarr to version 1.54.0 or later where the issue has been resolved.
What type of information can be disclosed through CVE-2026-27796?
CVE-2026-27796 allows unauthenticated users to retrieve a complete list of configured integrations, exposing sensitive integration metadata.
Which versions of Homarr are affected by CVE-2026-27796?
CVE-2026-27796 affects all versions of Homarr prior to version 1.54.0.
Who is at risk from CVE-2026-27796?
Users running affected versions of Homarr are at risk, as unauthorized individuals may access integration details.