Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-71260 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON "state" field correctly masked as "********", but the same serialization path unconditionally writes the raw password into the JSON "value" field via set_json_icon_state_value/set_json_value.

Metrics

CVSS 3.x Severity and Vector Strings:

NDDVolerionCVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA: TuranSecCVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/esphome/esphome TuranSecVendor
https://github.com/esphome/esphome/blob/dev/esphome/components/web_server/web_server.cpp TuranSecSource CodeVendor

Weakness Enumeration

CWE-IDCWE NameSource
CWE-522Insufficiently Protected CredentialsTuranSec

Affected Products

ProductVersions
ESPHome
<= 2026.7.0-dev (semver)

CPE

  • cpe:2.3:a:esphome:esphome:*:*:*:*:*:*:*:*
  • cpe:2.3:o:esphome:esphome_firmware:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

3 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-71260
NVD Published Date:
Aug 5, 2026
NVD Last Modified:
Aug 26, 2026
Source:
TuranSec
CVE-2026-71260 Details - Not Deferred