CVE-2026-59177

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the `Home Assistant` host's LAN interface. Any device on that local network can therefore connect directly to the `ingress` port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through `external_components:`, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted `Home Assistant` configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/esphome/device-builder/commit/b6387db3f8bf1d3df5771f40e9856b959ae4f6a1
https://github.com/esphome/device-builder/pull/1565
https://github.com/esphome/device-builder/releases/tag/1.0.10
https://github.com/esphome/device-builder/security/advisories/GHSA-vv4j-m4vr-f3g6

Configurations

No configuration.

History

28 Oct 2026, 14:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-28 14:17

Updated : 2026-10-28 15:24

NVD link : CVE-2026-59177

Mitre link : CVE-2026-59177

CVE.ORG link : CVE-2026-59177

JSON object : View

Products Affected

No product.

CWE

CWE-1327

Binding to an Unrestricted IP Address

{"id": "CVE-2026-59177", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "esphome", "product": "device-builder", "versions": [{"status": "affected", "version": "< 1.0.10"}]}]}], "published": "2026-10-28T14:17:04.747", "references": [{"url": "https://github.com/esphome/device-builder/commit/b6387db3f8bf1d3df5771f40e9856b959ae4f6a1", "source": "security-advisories@github.com"}, {"url": "https://github.com/esphome/device-builder/pull/1565", "source": "security-advisories@github.com"}, {"url": "https://github.com/esphome/device-builder/releases/tag/1.0.10", "source": "security-advisories@github.com"}, {"url": "https://github.com/esphome/device-builder/security/advisories/GHSA-vv4j-m4vr-f3g6", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1327"}]}], "descriptions": [{"lang": "en", "value": "ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the `Home Assistant` host's LAN interface. Any device on that local network can therefore connect directly to the `ingress` port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through `external_components:`, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted `Home Assistant` configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10."}], "lastModified": "2026-10-28T15:24:56.033", "sourceIdentifier": "security-advisories@github.com"}