Home Assistant at Internet Scale: 2.7 Million Fingerprint Matches and the Automation Control Plane

Home Assistant is a local-first automation platform: one host that talks to lights, locks, cameras, thermostats and alarm panels, and presents them through a single interface. The design goal is that the house keeps working when the internet does not, which is why the software is commonly run on a small device inside the home rather than in a data centre.
That design also makes the host unusually valuable. A system holding credentials for every device in a building is a system whose compromise is measured in physical outcomes rather than in leaked records, and the project's remote access options mean a large number of installations are reachable from outside the home on purpose.

Context and method

ZoomEye indexes internet-facing services and supports search by application fingerprint, so an installation can be located without scanning address space. The query used for this article was:

app="Home Assistant"

The query was executed with sub_type set to all and recorded as the primary result for this topic. It returned 2,711,859 fingerprint matches, collected from the ZoomEye index on 2026-09-23 (UTC).
Two clarifications about what that figure is. The unit is a fingerprint match in the index, not a confirmed installation and not a vulnerable host. A match means ZoomEye observed a service whose response identified the product; whether the operator intends it to be reachable, and what is available beyond the login page, has to be verified against a specific host. The second point is the reason to use a search engine of this kind in the first place: it answers how much of a product is visible from the internet, which no single operator can determine from their own estate.

What the exposure means in practice

The project documents TCP port 8123 as the default for the web interface, and its HTTP integration documents the settings that govern how requests are trusted and how a reverse proxy in front of the instance should be configured.
Many of the matches are fronted by a reverse proxy terminating TLS, so the indexed service may be the proxy rather than the application itself. The distinction matters when deciding whether a specific host is in scope.
The platform supports multi-factor authentication, and the documentation covers the setup. An installation that predates that configuration, or one where remote access was enabled through a port forward, is the type that deserves attention first.
Long-lived access tokens are the documented mechanism for integrations and scripts to call the API without an interactive session. Each token is a credential with no expiry of its own, and the inventory of issued tokens is rarely reviewed after the integration was first set up.
Add-ons and the supervisor layer extend the platform's reach into the host operating system. An exposed instance is not only an automation interface; depending on which add-ons are installed, it can be a management surface for the machine underneath.
A fingerprint match does not establish a weakness. It establishes that the surface exists and that someone, somewhere, can reach it. Whether that is acceptable is an operational decision that has to be made per installation, because the consequences of a bad decision include control of doors and cameras.

Implications

ZoomEye provides a way to quantify a class of exposure that is usually invisible: consumer-grade automation platforms that were designed for a private network and then connected to the public one. For defenders the value is in the ratio between what is exposed and what should be, and in the ability to check whether an organisation's own installations appear in the index at all.
The practical steps follow from that:

Locate the installations. For a household or a small organisation that means checking whether the instance appears in a fingerprint search; for a managed environment it means deciding whether such software should be reachable from the internet at all.
Prefer an authenticated access path to a port forward. A VPN or a managed tunnel keeps the login page off the public internet, which removes the entire class of finding.
Enable multi-factor authentication and review the trusted-network settings, since a trusted-proxy or trusted-network rule that is broader than intended changes who can reach the interface without a password.
Audit long-lived access tokens and remove the ones that no longer correspond to a running integration.
Keep the platform and its add-ons current, and treat the host as a device that holds physical-world authority: separate it from other systems where practical, back up its configuration, and monitor for unexpected authentication attempts.
Remember that the failure mode is not a data breach in the conventional sense. It is a house that can be unlocked, watched, or inconvenienced by someone who should not have access.