TP-Link has published a security advisory for a high-severity flaw in the local management protocol used by many Kasa smart plugs, switches and bulbs, and the fix comes with a catch that matters most to Home Assistant users. Updating your device closes the security hole, but in some cases it can also interrupt local control until you change one setting in the Kasa app. If you own Kasa hardware, the right move is to update first and then check that setting, rather than assuming your automation has broken for another reason.
What TP-Link disclosed
On October 14, 2026, TP-Link published an advisory for CVE-2026-108473, described as an improper authentication vulnerability in the local device-management protocol used by multiple Kasa devices. TP-Link rated the issue 8.7 out of 10 under its CVSS scoring. In practical terms, the advisory describes a flaw that could allow someone on the same local network, without any credentials, to send management commands to an affected device and change its settings.
TP-Link also noted a separate account-related concern: under some conditions, traffic between the app, the device and TP-Link’s cloud could expose account information, which it said could in some cases lead to a compromised cloud account. The core issue, however, is local. It concerns the protocol that local tools use to talk to the device on your own network, not a remote attack launched from anywhere on the internet.
The advisory lists 23 device and hardware-version combinations, each with the firmware version that fixes it. Two examples illustrate how the rollout works in practice. The Kasa KS220M dimmer switch, hardware version V1, is listed with fixed firmware 1.1.6 Build 250522. The KP303 power strip, hardware version V2, is listed with fixed firmware 1.1.2 Build 241220. Owners should check their exact model and hardware version against TP-Link’s advisory, because the same model name can cover different hardware revisions with different fixed firmware.
Why some owners may already be patched
One detail in the advisory deserves attention: the fixed firmware for some devices is not brand new. The build number in the KS220M’s 1.1.6 Build 250522 points to May 22, 2025, meaning the fix itself shipped well before the October 2026 disclosure. If your KS220M has been taking automatic updates since mid-2025, it may already be on or past the fixed version.
That does not make the advisory irrelevant. Automatic updates are not universal, and not every affected model will have received its fix on the same schedule. The safest approach is still to open the Kasa app, check for firmware updates, and confirm your device is running at least the version TP-Link lists for your model and hardware version. Do not assume a device is safe simply because it is a recent purchase or because it still works normally.
The Home Assistant side effect
The complication is separate from the vulnerability itself, but it is easy to confuse the two. Home Assistant’s own TP-Link integration documentation carries a standing warning: some firmware versions require explicit activation of third-party integrations before they allow access from Home Assistant. The setting is called Third-Party Compatibility, and it lives in the Kasa app under Settings.
Home Assistant’s documentation also notes that newer Kasa devices need your TP-Link cloud account credentials to authenticate even a purely local session. In other words, local here means the control traffic stays on your network, not that a TP-Link account is optional. That distinction matters when you are troubleshooting, because a device can be reachable on your network and still refuse a local connection until the account and compatibility requirements are satisfied.
Public reports show the pattern in action. A TP-Link community thread from October 2025 describes a KS220M running firmware 1.1.6, the same version TP-Link now lists as the fix for this vulnerability, that stopped responding to Home Assistant while still working from the Tapo app. A TP-Link staff reply in that thread said Home Assistant is not an officially supported third-party platform, made no guarantee about it, and pointed to the Third-Party Compatibility switch as the available workaround. The original poster flipped the switch, restarted the device and Home Assistant, and regained control. A second user in the same thread reported that the switch did not fix an HS300 running a different firmware version, so it is not a guaranteed remedy for every model.
A separate closed GitHub issue from September 2026 describes the same pattern on a KP125M running firmware 1.4.1, resolved only by the same toggle. Home Assistant’s maintainers used that report to clarify their documentation across Kasa and Tapo devices, rather than changing integration code. Taken together, these reports do not prove that the security fix itself breaks Home Assistant. They show that the same firmware family has carried this third-party requirement for more than a year, and that it is easy to update a Kasa device for security and then wonder why Home Assistant stopped seeing it.
What to do now
- Update first. In the Kasa app, check for firmware updates on every Kasa plug, switch and bulb you own, and install the version TP-Link lists for your exact model and hardware version.
- Check Third-Party Compatibility. In the Kasa app, go to Settings and confirm Third-Party Compatibility is switched on, especially before you conclude that Home Assistant is broken.
- Restart both ends. If local control is missing after an update, restart the Kasa device and restart Home Assistant, then check whether the device reappears.
- Check the exact model. The Kasa KP125M plug, for example, does not appear in TP-Link’s advisory for this vulnerability. That is not a clearance and not a warning; it simply means TP-Link’s page makes no claim either way for that model, so owners should keep watching for updates.
- Do not remove working hardware in a panic. Nothing in the advisory suggests pulling a switch or plug out of the wall. Patching and checking the compatibility setting is the proportionate response.
Who does not need to worry
If you control your Kasa devices only through the Kasa app, Alexa or Google Home, this advisory does not change your setup. The vulnerability concerns the local management protocol that Home Assistant and similar tools use; the Kasa app and the major voice assistants go through TP-Link’s own supported path. That does not mean those users should skip updates, but it does mean they are unlikely to hit the Third-Party Compatibility problem.
For Home Assistant households shopping for a Wi-Fi dimmer or plug, the advisory is also not, on its own, a reason to strike Kasa off a shortlist. It is a reason to check Third-Party Compatibility the first time you set any Kasa device up, rather than only after something stops working. Security advisories like this one are a normal part of owning connected hardware; the useful habit they reinforce is checking firmware and compatibility settings as a pair, not one without the other.
What to watch next
The open questions are practical rather than dramatic. TP-Link’s advisory covers a defined list of models and hardware versions, and owners of models outside that list will want to know whether they are added later. Home Assistant users will also want to see whether TP-Link clarifies the role of Third-Party Compatibility for newer firmware, or whether it remains an unofficial workaround for a platform TP-Link does not formally support. Until then, the advice stays simple: keep firmware current, keep the compatibility switch on if you use Home Assistant, and treat a sudden loss of local control after an update as a settings check first and a hardware problem second.