ESPHome Device Builder <1.0.10 - Unauthenticated Dashboard Access

ESPHome Device Builder versions before 1.0.10 bind the trusted Home Assistant ingress site to all interfaces. A client that can reach the ingress port can therefore access the dashboard without the Supervisor's authentication proxy. id: CVE-2026-59177 info: name: ESPHome Device Builder 1.0.10 -...

espectre

ESPectre Turn an ESP32 into a private, local Wi-Fi motion sensor. When someone moves through a room, they change the way Wi-Fi signals travel through it. ESPectre reads those changes and reports motion in real time. No camera, no microphone, no wearable, and no dedicated radar hardware: just a...

CVE-2026-59177

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the Home Assistant add-on's trusted ingress site binds to 0.0.0.0 while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream...

CVE-2026-59177 ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the Home Assistant add-on's trusted ingress site binds to 0.0.0.0 while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream...

CVE-2026-59177 ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the Home Assistant add-on's trusted ingress site binds to 0.0.0.0 while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream...

CVE-2026-59177

The ESPHome Device Builder Dashboard (versions prior to 1.0.10 ) is vulnerable to unauthenticated access when running as a Home Assistant add-on using host networking. The issue arises because the trusted ingress site binds to 0.0.0.0, allowing any device on the local network to bypass the superv...

Security and Robustness Analysis of Encrypted Communications for Local Home Automation: ESPHome Native API and MQTT over TLS 1.3

The expansion of the Internet of Things IoT in residential and local automation environments has highlighted the limitations of considering the internal network as an inherently trusted domain. Man-in-the-middle MitM attacks, such as ARP spoofing, can allow traffic interception or manipulation wh...

aksharify (0.2.0), chem-eclipse (0.1.0) +56 more potentially affected by CVE-2026-107378 via cairosvg (>=2.1.3, <=2.9.0)

cairosvg PYPI version =2.1.3, =0.1.0, =0.20.7, =1.0.0b1, =1.5.3, =1.5.3, =1.5.3, =0.0.2, =2025.5.0b2, =1.0.0, =2.1.0 and more Source cves: CVE-2026-107378 Source advisory: GHSA-C3JG-QH8M-J3H2...

aksharify (0.2.0), chem-eclipse (0.1.0) +56 more potentially affected by CVE-2026-107378 via cairosvg (>=2.1.3, <=2.9.0)

cairosvg PYPI version =2.1.3, =0.1.0, =0.20.7, =1.0.0b1, =1.5.3, =1.5.3, =1.5.3, =0.0.2, =2025.5.0b2, =1.0.0, =2.1.0 and more Source cves: CVE-2026-107378 Source advisory: OSV:GHSA-C3JG-QH8M-J3H2...

ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

SummaryThe dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who...

PYSEC-2026-4049 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

Summary The dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who...

PT-2026-105806

Summary The dashboard reads its authentication credentials from $ESPHOME USERNAME and $ESPHOME PASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator w...

CVE-2026-59178

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

CVE-2026-59178 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

CVE-2026-59178

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from "$ESPHOMEUSERNAME" and "$ESPHOMEPASSWORD". Earlier versions, and the legacy "esphome" dashboard, read the bare "$USERNAME" and...

CVE-2026-59178 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

EUVD-2026-77758

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

CVE-2026-59178

ESPHome Device Builder Dashboard prior to version 1.0.12 silently loses dashboard authentication after an upgrade. The root cause is that authentication credentials were read from $USERNAME/$PASSWORD in earlier versions, but after being renamed to $ESPHOME_USERNAME/$ESPHOME_PASSWORD, the bare nam...

CVE-2026-59178 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

Summary The dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who...