This is an automated archive made by the Lemmit Bot.
The original was posted on /r/homeassistant by /u/svideo on 2026-08-12 12:11:38+00:00.
My home network has a single open port on the firewall to allow tailscale connections with certs. HA access happens through a paid Nabu Casa account with remote access enabled. I've been seeing daily attack attempts coming in through this channel and it appears to be escalating in frequency. Nabu doesn't pass through the client IP so I don't have any good way to block by IP range or similar.
Back in March someone noted this and a forum moderator suggested:
The cloud team is working on passing through the actual connecting IP address but as everything is end-to-end encrypted it’s not so simple. Hopefully soon!
Example log entries, in this case they're attempting a Vite exploit:
2026-08-10 22:08:58.758 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /@fs/proc/self/environ?raw??
2026-08-10 22:08:58.763 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /@fs/../.env?raw??
2026-08-10 22:08:58.767 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??
2026-08-10 22:08:58.771 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??
2026-08-10 22:08:58.780 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /@fs/../../.env?raw??
2026-08-10 22:08:58.784 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /@fs/..%252f..%252f..%252f..%252f..%252fapp/.env?raw??
These are the attacks that were recognized and blocked by HA itself. I'm more worried about attacks that aren't being recognized.
Is anyone else seeing this? For me the initial indicator are random, daily notifications that an invalid login attempt from 127.0.0.1 was attempted.