🚨 Upgrade Advisory: openHAB 5.2.2 🚨

The openHAB community has released version 5.2.2. This release addresses multiple high-risk CVEs. If your current deployment is running on 5.2.1 or earlier, a review of your configuration is recommended to ensure the security of your setup.

Security Enhancements

The following changes are breaking and must be accounted for before the upgrade process completes. Failure to adapt to these settings will result in service disruption.

Network & Proxy Integrity

The openHAB distribution now enforces a strict allowlist for the sitemap and proxy endpoints.

Proxy Restrictions

You must explicitly define the allowed external hosts within the system settings. If your sitemaps relied on proxied content (e.g., camera feeds or external web widgets), they will cease functioning until the required hosts are added to the allowedHosts setting.

Trusted Network Validation

Hardened trust evaluation:trustedNetworks is now evaluated against the actual client IP.

If you run openHAB behind a reverse proxy, do not list the proxy's internal IP or the loopback address (e.g., 127.0.0.1) in your trusted networks. Doing so implies you trust every client behind that proxy, which is a severe security misconfiguration.

 External Service Authentication

The security requirements for OAuth2 clients have been significantly increased to prevent authorisation code theft.

All third-party OAuth2 clients must strictly adhere to the principle that the redirect_uri is the exact origin of the openHAB instance. Furthermore, the use of PKCE (S256) is now mandatory for the /auth endpoint.

IP Camera Binding: XML parsing for IP Camera events has been hardened.

If your camera events are routed through a non-direct path (e.g., NAT or a secondary proxy), you must manually add the event source's IP address to the ipWhitelist configuration.

Read the full details and audit the changes before starting the upgrade.

openHAB 5.2.2 Release

This arcticle and the illustrations were created using AI tools and agents.