ESPHome Device Builder ingress site skips authentication on LAN
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
ESPHome Device Builder Dashboard versions before 1.0.10 are affected. The Home Assistant add-on's trusted ingress site binds to all interfaces and skips dashboard authentication, so host networking exposes it to the local network. Any device on that network can connect to the ingress port without credentials (CWE-1327). The dashboard allows Python execution through external_components, shell execution through compile and validation subprocesses, and access to configuration and data files.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the `Home Assistant` host's LAN interface. Any device on that local network can therefore connect directly to the `ingress` port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through `external_components:`, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted `Home Assistant` configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| esphome | device-builder | before 1.0.10 | 1.0.10 | Patch available | CNA |
| — | esphome-device-builder (PyPI) | before 1.0.10 | 1.0.10 | Patch available | GHSA-vv4j-m4vr-f3g6 |
- device-builder Vendoresphome Affected before 1.0.10 Fixed in 1.0.10 Patch available CNA
- esphome-device-builder (PyPI) Vendor— Affected before 1.0.10 Fixed in 1.0.10 Patch available GHSA-vv4j-m4vr-f3g6
Remediation
Update ESPHome Device Builder to version 1.0.10 or later, which is the fixed version listed for the PyPI package esphome-device-builder. The sources list no fixed version for the esphome device-builder vendor entry.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA device-builder (esphome) Fixed in 1.0.10
- Fix · GHSA-vv4j-m4vr-f3g6 esphome-device-builder (PyPI) Fixed in 1.0.10 Advisory →
Timeline
- 2026-10-28 Threatist record created from CVE-2026-59177
- 2026-11-02 CISA SSVC decision points changed
References
Other 5
- https://github.com/esphome/device-builder/security/advisories/GHSA-vv4j-m4vr-f3g6
- https://github.com/esphome/device-builder/pull/1565
- https://github.com/esphome/device-builder/commit/b6387db3f8bf1d3df5771f40e9856b959ae4f6a1
- https://github.com/esphome/device-builder/releases/tag/1.0.10
- https://github.com/esphome/device-builder
More esphome vulnerabilities
- TI-2024-17944 ESPHome remote code execution via arbitrary file write CVSS 3.1HIGH 8.8
- TI-2025-35691 ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header CVSS 3.1HIGH 8.1
- TI-2024-19201 ESPHome vulnerable to Authentication bypass via Cross site request forgery CVSS 3.1HIGH 8.1
- TI-2026-42331 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade CVSS 3.1CRITICAL 9.8
- TI-2026-19197 ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component CVSS 4.0LOW 1.7
- TI-2024-18126 ESPHome vulnerable to stored Cross-site Scripting in edit configuration file API CVSS 3.1HIGH 8.7
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences