CVE-2026-59177 ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-59177?
CVE-2026-59177 is a high-severity vulnerability in esphome device-builder, published on 28 Oct 2026.
Official description
ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the `Home Assistant` host's LAN interface. Any device on that local network can therefore connect directly to the `ingress` port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through `external_components:`, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted `Home Assistant` configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10.
Weakness: CWE-1327
Which versions are affected by CVE-2026-59177?
3 open source packages ship an affected version, including esphome-device-builder.
| Package | Affected | Fixed in |
|---|---|---|
esphome-device-builder PyPI | All versions | 1.0.10 |
esphome-device-builder PyPI | All versions | 1.0.10 |
esphome-device-builder PyPI | All versions | 1.0.10 |
How do I fix CVE-2026-59177?
Upgrade esphome-device-builder to 1.0.10 or later.
Is CVE-2026-59177 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59177 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-vv4j-m4vr-f3g6, PYSEC-2026-3834.