esphome device-builder vulnerabilities

Latest esphome device-builder CVEs

Newest publication first

1. CVE-2026-59177 ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

   Published 2026-10-28

   High·CVSS 8.8 EPSS 1.2%

   ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the Home Assistant add-on's trusted ingress site binds to 0.0.0.0 while intentionally skipping dashboard authentication because the supervisor is expected to authenticate re...

2. CVE-2026-59178 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

   Published 2026-09-14

   Critical·CVSS 9.8 EPSS 0.78%

   ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOME_USERNAME and $ESPHOME_PASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $U...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.