CVE-2026-53456
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Blueprint Studio before version 2.5.2 in terminal SSH key authentication writes SSH private-key material to a file under the Home Assistant configuration directory before applying restrictive permissions and relies on best-effort cleanup. The key could temporarily remain on disk and could persist if cleanup failed or Home Assistant crashed. A user or process with filesystem access to the Home Assistant configuration directory could obtain the residual private key.
Risk Assessment
A residual SSH private key could be captured by individuals or processes with filesystem access, potentially leading to unauthorized access to remote systems.
Recommendation
Upgrade Blueprint Studio to version 2.5.2 or later, which includes the fix.
Original NVD description (English source)
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in custom_components/blueprint_studio/backend/terminal_manager.py wrote SSH private-key material to a file under the Home Assistant configuration directory before applying restrictive permissions and relied on best-effort cleanup. The key could temporarily remain on disk and could persist if cleanup failed or Home Assistant crashed. A user or process with filesystem access to the Home Assistant configuration directory could obtain the residual private key. This issue is fixed in version 2.5.2.