CVE-2026-59177

The record

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the `Home Assistant` host's LAN interface. Any device on that local network can therefore connect directly to the `ingress` port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through `external_components:`, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted `Home Assistant` configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10.

Affected packages

Related vulnerabilities

• CVE-2026-119249 A malicious actor with access to the network could exploit a Binding to an Unrestricted… CWE-1327
• CVE-2026-92559 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to… CWE-1327
• CVE-2026-75021 fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the… CWE-1327
• CVE-2026-20212 A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could… CWE-1327
• CVE-2026-72924 GitHub CLI (gh) is GitHub's official command line tool. CWE-1327
• CVE-2026-16713 IBM Documentation Offline 1.0.0 through 1.4.1 IBM Documentation could allow a remote… CWE-1327
• CVE-2026-16503 Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that… CWE-1327
• CVE-2026-47873 The Boot Dashboard Docker integration in Spring Tools publishes container control ports… CWE-1327