For two days now, I have been getting the notification like below saying that there has been an invalid authentication from the Local host IP 127.0.0.1. I am running my HA on a Rasberry PI, and do use Nabu Casa. The time stamps for these seem to happen in the middle of the night and none of my PC’s are on-line during these times, so don’t think it happening from on of my local network computers. If I am compromised, I’m not sure the best way to fix it. Does anyone have some guidance?
[homeassistant.components.http.ban] Login attempt or request with invalid authentication from localhost (127.0.0.1). Requested URL: ‘/api/config’. (Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/91.0.4472.124)
[homeassistant.components.http.security_filter] Filtered a potential harmful request to: /proc/self/environ
That’s someone (bot, crawler, script kiddie) scanning public URLs for known vulnerabilities in other services. /proc/self/environ is a Linux exploit path that leaks environment variables (and sometimes credentials) on vulnerable setups. It doesn’t exist as a route in HA, so the request just fails. Basically like going through a street and checking car doors to see if any are unlocked.
This is common to see and you just happen to be the address out of thousands of others that this is crawling through probably.
As this is coming through Nabu Casa access, the incoming address isn’t known and it appears as the loopback address 127.0.0.1
If you had ip_bans enabled this would eventually result in a 403 forbidden response when the number of tries is met which would block 127.0.0.1 and then you’d be locked out of using the remote URL until that was cleared. The cloud team is working on passing through the actual connecting IP address but as everything is end-to-end encrypted it’s not so simple. Hopefully soon!
You could instead enable MFA for your user account for extra security, but this bot is just going to continue to fail to find this path and move on eventually.
Giggles. Invoking MFA on 127.0.0.1 is quickly going to seize things up!
As for external compromise, what do you have that is exposed to the outside world other than NabuCasa?
The entry recorded is for an unsuccessful attempt. The ones you should be more worried about are the successful ones.
Watching a live firewall log may shock you. The baddies out on the internetz are relentless. The fact the filter picked it up and reported it means there is the ability to recognise it as having bad intent, maybe something NabuCasa might be able to filter at their end, leading to a smaller attack window for their users and less log entries being recorded.
From experience of fixing customers systems, unless you are being targeted by state actors (yes they are viciously active especially in the current world militant situation), most of these scans are by unsophisticated skript kiddies wannabe hackers, university researchers and their students looking for low hanging fruit. If your system is misconfigured, you stand a higher chance of vandalism rather than subtle infiltration. Small comfort, but similar to leaving your car unlocked on a Saturday night downtown. Your belongings will be ruffled through, anything of value taken, and then maybe they will torch your car or take it for a joy ride and dump it, just for the lulz. A state actor will plant tracking devices, carefully close the doors and leave, with you none the wiser. Both are undesirable, and if it happens to you, leaving you with an experience like being anally raped.
Having your inbound traffic anonymised by NabuCasa places a larger responsibility on them to filter undesirable traffic. Be sure to continue to work with their tech support to identify and close any opportunities for attack.
Like Clifford Stoll in his book “The Cuckoo’s Egg”, identifying who is fiddling on your system should be relentlessly persued, and if within your remit, “exterminated with extreme prejudice”.
Wouldn’t it be embarrassing if it was actually Claude rummaging around?
I’m getting hit with these every day now, from a wide range of agents. I have no ports open on my firewall, remote access happens through Nabu Casa cloud. These are obvious and clear exploit attempts that are being routed into my home via your cloud service, and as you note, it’s essentially impossible to block this without locking myself out.
It’s been half a year - any progress on not allowing attackers to query my network through your cloud?
Here are some examples, this of course is only showing the failures and I have no idea if any are actually getting through. I’m getting hit with this every day and it’s all coming from Nabu Casa:
2026-08-10 22:08:58.758 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /@fs/proc/self/environ?raw??
2026-08-10 22:08:58.763 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /@fs/../.env?raw??
2026-08-10 22:08:58.767 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??
2026-08-10 22:08:58.771 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??
2026-08-10 22:08:58.780 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /@fs/../../.env?raw??
2026-08-10 22:08:58.784 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /@fs/..%252f..%252f..%252f..%252f..%252fapp/.env?raw??
2026-08-10 22:09:24.446 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /@fs/..%2f..%2f..%2f..%2f..%2froot/.env?raw??
2026-08-10 22:09:24.456 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /@fs/../../../../../app/.env?raw??
2026-08-10 22:09:24.472 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /@fs/..%2f..%2f..%2f..%2f..%2fapp/.env?raw??
2026-08-10 22:09:24.480 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /@fs/../../../../../root/.env?raw??
2026-08-10 22:09:24.496 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ?raw??
2026-08-10 22:09:24.504 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /@fs/../../../../../proc/self/environ?raw??
2026-08-10 22:10:00.825 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /_next/../.env
2026-08-10 22:10:00.880 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /_next/static/../.env
2026-08-11 19:53:29.543 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from localhost (127.0.0.1). Requested URL: '/api/config'. (anthropic-ai)
2026-08-11 19:53:33.710 WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a potential harmful request to: /@fs/proc/self/environ?import&raw??
This needs to be top priority. Just because you’re seeing some attempts blocked, doesn’t mean there isn’t a HA zero-day being exploited without us knowing.