CVE-2026-59177 Details
Description
ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the `Home Assistant` host's LAN interface. Any device on that local network can therefore connect directly to the `ingress` port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through `external_components:`, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted `Home Assistant` configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10.
A vulnerability in the ESPHome Device Builder Dashboard's Home Assistant add-on allows unauthenticated access to the dashboard via a trusted ingress site. This issue affects versions prior to 1.0.10. The ingress site, which is supposed to be authenticated by the Home Assistant supervisor, was incorrectly bound to all network interfaces. As a result, any device on the same local network could access the dashboard without credentials, bypassing the intended authentication. The vulnerability arises from the add-on's host-network configuration, which exposed the no-auth site on the LAN. The issue is now fixed in version 1.0.10.
Users can upgrade to ESPHome Device Builder Dashboard version 1.0.10 or later, which fixes the vulnerability by binding the ingress site to loopback and the supervisor gateway only, and by adding a peer guard that rejects any TCP peer other than loopback or the supervisor.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/esphome/device-builder/commit/b6387db3f8bf1d3df5771f40e9856b959ae4f6a1 | [email protected] | Source CodeVendor |
| https://github.com/esphome/device-builder/pull/1565 | [email protected] | Issue TrackingVendor |
| https://github.com/esphome/device-builder/releases/tag/1.0.10 | [email protected] | Release NotesVendor |
| https://github.com/esphome/device-builder/security/advisories/GHSA-vv4j-m4vr-f3g6 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1327 | Binding to an Unrestricted IP Address | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ESPHome Device Builder | < 1.0.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |