Home Assistant 2026.9 opens the Modbus bus and tightens its security surface
On September 2, 2026, Home Assistant 2026.9 modernizes Modbus so an industrial device can be picked from the UI without writing any YAML, and hardens the instance by passing through the real source IP of Cloud connections so IP banning actually works. Upgrade if you run Modbus gear or expose your instance.
September 2, 2026. Home Assistant ships version 2026.9, and the biggest change is not the flashiest one. Frenck, who wrote the release notes, is blunt about it: Modbus “has never been the flashiest part of Home Assistant” — yet it quietly runs solar inverters, heat pumps, and energy meters, provided you are willing to hand-write your own register map in YAML. 2026.9 removes that wall. The same release also tightens the security surface of an exposed instance. Two workstreams, one delivery.
Modbus moves from YAML to the UI
Modbus is the de facto protocol of industrial and energy equipment: meters, inverters, heat pumps, ventilation systems. Until 2026.9, adding such a device to Home Assistant meant knowing its register and describing it by hand. The result: a large category of hardware stayed out of reach of non-specialist users.
2026.9 changes the model. Integrations that already know how to talk Modbus to a given device now share a single connection instead of fighting over the same serial link. In practice, you pick the device in the UI like any other peripheral, rather than writing a register map. Frenck’s note is explicit: “it won’t show up in a screenshot, but modernizing Modbus is hands-down my favorite change this release.”
For self-hosting applied to energy, that is a real unlock: the barrier separating home automation from industrial gear falls. An inverter or a Modbus meter becomes an ordinary device.
Seeing through the Cloud: the real IP, finally
The second half of the release matters most to anyone who exposes their instance. Until now, connection attempts coming through Home Assistant Cloud all appeared to originate from 127.0.0.1 — a near-useless failed-login message that hid the real origin. 2026.9 now passes through the real source IP.
The consequence is immediate: IP banning — added to the UI in the previous release — becomes usable to block malicious attempts. Combined with two-factor authentication (2FA), this adds a genuine layer of protection to an exposed home instance. A useful side effect: you can finally tell your own password mistake apart from a bot “trying its luck.”
Security: sensitive actions become admin-only
2026.9 continues a quieter but structural hardening. Installing an update, skipping an update, or clearing a skipped update now require an administrator account. These are configuration-level actions, now treated like other sensitive actions on the platform.
The same logic applies to Z-Wave: the actions that manage lock users and credentials (set_user, delete_user, set_credential, delete_credential, and others) now require an administrator account. For a system that controls door locks, that is a sensible fix: a script run by a non-privileged user can no longer change physical access.
Automations are unaffected — they run without a user context — but a script started by a non-admin that attempts these actions will now fail. The documented workaround: trigger it from an automation or run it as an admin.
The rest: Matter, voice, accessibility
The rest of the release is dense. A new Matter network map visualizes the topology of your Matter nodes. The Security dashboard gains active alerts and favorites. A shared Sources panel across History and Activity groups where changes come from, and Activity now explains why something changed, not just that it did.
On the Cloud side, a new speech-to-text engine (provider Soniox) specifically targets accents, background noise, and non-English languages — available via Labs, with the same no-logging, no-training-on-your-audio guarantee. Finally, 13 new integrations land, charts become keyboard- and screen-reader-navigable, and 2026.9.1 already shipped early fixes on September 5.
Under the hood: the backward-incompatible changes
As with every major release, 2026.9 ships backward-incompatible changes worth knowing before you upgrade. The most visible concerns the robot vacuum: the deprecated battery_level property was removed from the base entity. All core integrations had already migrated in 2026.8; a custom integration that still sets this property will no longer report a battery level — add a separate battery sensor instead.
On the development side, the Configurator integration is deprecated, and the device registry WebSocket API changes, with new deprecations and validation helpers. For an end user, this is invisible; for anyone maintaining a custom integration, it is a reminder that Home Assistant regularly tightens its API contracts, and that an unmaintained integration eventually breaks across major versions.
These changes confirm the release’s overall direction: less implicit surface, more explicit controls. The removed property, the admin-only action, and the deprecated API all belong to the same movement — making the system’s behavior more predictable and safer by default.
A concrete stake: home energy self-consumption
Behind the Modbus modernization is a use case on the rise: solar self-consumption. Inverters, meters, and home batteries overwhelmingly speak Modbus, and driving them from Home Assistant becomes the natural step for anyone optimizing their consumption or grid injection.
Until 2026.9, that promise ran into the register map: every brand, sometimes every model, exposes its registers differently, and a single mapping error left the integration silent. By delegating protocol knowledge to the integrations that already hold it, Home Assistant turns the inverter or meter into an ordinary entity — measurable, automatable, scriptable like any sensor.
The gain is not cosmetic. It lowers the entry cost of home energy automation to a point where you no longer need to be an electrical engineer to make a Modbus meter talk to your charging, load-shedding, or demand-response scripts.
The smaller-but-useful changes
Beyond the headlines, 2026.9 ships a batch of smaller quality-of-life improvements worth noting. Automations can now trigger on golden hour, blue hour, and polar sun — the kinds of lighting events that matter in high latitudes, where a fixed clock time is meaningless for part of the year. New Serial and MQTT panels give direct visibility into those low-level transports, useful when debugging a flaky device. And the dashboard can now surface how full your network storage is, closing a gap for users who back up to a NAS and only notice the disk is full when the backup fails.
None of these changes is revolutionary on its own. Together, they continue a pattern that has defined Home Assistant for years: the release notes read like a checklist of the papercuts a real home-automation operator hits in practice, not a list of marketing features. That is exactly why the project keeps growing while proprietary hubs stagnate.
Verdict
Home Assistant 2026.9 is two releases in one. On one side, it lowers the barrier to a whole class of industrial Modbus equipment; on the other, it closes gaps in the exposed surface — real IPs, IP banning, sensitive actions restricted to admins.
If you run Modbus equipment (inverter, meter, heat pump), the upgrade is obvious: configuration moves from YAML to the UI, and existing integrations now share the link cleanly. If your instance is exposed or routes through Home Assistant Cloud, enable IP banning and 2FA — the real IP passthrough finally makes that protection usable. If you manage Z-Wave locks, restricting credential actions to admins is reason enough on its own to switch. For everyone else, it is a low-urgency, low-risk update that keeps hardening the security posture.