Researchers successfully breached Home Assistant Green in five of six attempts at Pwn2Own Ireland 2026, chaining multiple vulnerabilities to expose weaknesses in the smart-home hub.
Home Assistant Green came under intense scrutiny at Pwn2Own Ireland 2026, where security researchers succeeded in compromising the smart-home hub five times in a single day. The results, first reported by PC Games Hardware and confirmed by the Zero Day Initiative, underline how attractive connected home controllers have become as targets for offensive security testing.
According to the Zero Day Initiative, the device was the most frequently targeted product on the second day of the competition. Six attempts were scheduled against it, and five ended in success. The opening win went to Yves Bieri of Xint, who collected a $30,000 reward. Yassine Bengana and Maxence Schmitt of Doyensec later achieved another compromise using three flaws that organisers and the manufacturer were already aware of, which reduced their payout to $7,500.
Later attempts showed how multiple weaknesses can be chained together. PetoWorks combined five vulnerabilities, three of them previously unknown, to complete its attack. Kyeongmin Kim of KAIST Hacking Lab needed four flaws, including one new issue, while researcher McCaulay finished the sequence with a chain of six vulnerabilities, five of which the ZDI said were new. That pattern suggests the device was not defeated by a single mistake, but by several layers of weakness that could be combined in different ways.
For users, the competition does not mean immediate exposure in ordinary home use, because Pwn2Own attacks are carried out under controlled conditions with defined rules. In the smart-home category, researchers must rely on reachable services, radio interfaces or other exposed functions rather than unrestricted access. Even so, the event is a reminder that Home Assistant users should apply updates quickly, including Core, the operating system and installed add-ons, and should avoid making their hubs directly reachable from the internet through port forwarding. Home Assistant recommends VPN access or its own cloud-based remote access instead, together with strong unique passwords, multi-factor authentication and as few administrator accounts as possible.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
