CVE-2026-59177— ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

Quick assessment

Affected

esphome device-builder

Exploitation

Public or AI PoC available; prioritize validation

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ESPHome Device Builder Dashboard 是 ESPHome 家庭管理软件的一个仪表盘组件。在 1.0.10 版本之前，Home Assistant 附加组件中受信任的站点绑定到，并故意跳过了仪表盘的认证流程，因为系统预期由 Supervisor（监督程序）在上游对请求进行认证。此外，为支持 mDNS 所需的主机网络配置，也将该无需认证的站点绑定到了 Home Assistant 宿主机的局域网接口。因此，同一局域网内的任何设备均可直接连接至端口，绕过 Supervisor，无需凭证或

CVSS 8.8 · High EPSS 1.17% · P67 Updated Oct 28, 2026

Public Exploits 1

Nuclei · 1 CVE-2026-59177.yaml [template]

Possible ATT&CK Techniques 2 AI

T1055 · Process Injection T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
esphome	device-builder	`< 1.0.10`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

Source: CVE Program / CVE List V5

Vulnerability Description

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the `Home Assistant` host's LAN interface. Any device on that local network can therefore connect directly to the `ingress` port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through `external_components:`, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted `Home Assistant` configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1327

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
esphome	device-builder	< 1.0.10	-

II. Public POCs for CVE-2026-59177

#	POC Description	Source Link	Shenlong Link
1	ESPHome Device Builder versions before 1.0.10 bind the trusted Home Assistant ingress site to all interfaces. A client that can reach the ingress port can therefore access the dashboard without the Supervisor's authentication proxy.	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-59177.yaml	POC Details