CVE-2026-59177

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the `Home Assistant` host's LAN interface. Any device on that local network can therefore connect directly to the `ingress` port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through `external_components:`, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted `Home Assistant` configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10.

• CWE-1327

• https://github.com/esphome/device-builder/commit/b6387db3f8bf1d3df5771f40e9856b959ae4f6a1
• https://github.com/esphome/device-builder/pull/1565
• https://github.com/esphome/device-builder/releases/tag/1.0.10
• https://github.com/esphome/device-builder/security/advisories/GHSA-vv4j-m4vr-f3g6

Published

Oct 28, 2026

Last Modified

Nov 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59168Dasel is a command-line tool and library for querying, modif…6.2
• CVE-2026-5917libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built w…8.8
• CVE-2026-59171JSON-java is a reference implementation of a JSON package in…5.9
• CVE-2026-59172Joker is a small Clojure interpreter, linter and formatter w…7.8
• CVE-2026-59173Uncontrolled Resource Consumption vulnerability in Apache Tr…7.5
• CVE-2026-59176Functype is a family of TypeScript functional programming li…7.8
• CVE-2026-59178ESPHome Device Builder Dashboard is a dashboard for the ESPH…9.8
• CVE-2026-59179OpenHop is a tool for creating interactive data-flow diagram…8.3
• CVE-2026-5918Inappropriate implementation in Navigation in Google Chrome …4.3
• CVE-2026-59180Apprise is an open source library which allows you to send a…3.1
• CVE-2026-59181OpenImageIO is a toolset for reading, writing, and manipulat…6.1
• CVE-2026-59183OpenEXR is the reference implementation and specification fo…5.5