Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-59178— ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

Quick assessment

Affected
esphome device-builder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ESPHome Device Builder Dashboard是ESPHome组织开源的一个智能家居设备固件构建工具。 ESPHome Device Builder Dashboard 1.0.12之前版本存在授权问题漏洞，该漏洞源于仪表盘身份验证凭据的环境变量重命名后未保留旧变量回退，导致原先使用USERNAME和PASSWORD保护的实例在升级后失去身份验证，任何可访问其端口的攻击者均可未经授权访问。

CVSS 9.8 · Critical EPSS 0.78% · P56

Affected Version Matrix 1

VendorProduct Version RangeStatus
esphome device-builder < 1.0.12 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-59178

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade
Source: CVE Program / CVE List V5
Vulnerability Description
ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from `$ESPHOME_USERNAME` and `$ESPHOME_PASSWORD`. Earlier versions, and the legacy `esphome` dashboard, read the bare `$USERNAME` and `$PASSWORD` instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who had protected their dashboard with `USERNAME` / `PASSWORD` (as the older getting started guide documented) loses authentication on upgrade and the dashboard starts open to anyone who can reach its port. The issue is fixed in 1.0.12. The bare `$USERNAME` / `$PASSWORD` are accepted again as a deprecated fallback so previously protected instances stay protected across the upgrade without operator intervention, with a loud deprecation warning at startup directing operators to rename them to `$ESPHOME_USERNAME` / `$ESPHOME_PASSWORD`. The fallback is gated on `$PASSWORD` being set and is only adopted as a pair, so the OS provided `$USERNAME` is never read on its own and the original collision footgun stays closed. A lone bare `$PASSWORD` with no username still fails loud as a credential mismatch rather than starting unauthenticated. This restores compatibility rather than failing closed on the legacy names, because the priority is that an instance which was protected before the upgrade stays protected without the operator having to act; the deprecation warning plus a future removal handles the migration. Operators should migrate to the `$ESPHOME_*` names. The esphome container delivers the fix in the 2026.6.2 release, which bumps its pinned `esphome-device-builder` version to 1.0.12. Without upgrading, restore authentication immediately by setting the new env vars to the same values, on any affected version. Alternatively, do not expose the dashboard port to untrusted networks, and check the startup logs for the `WITHOUT AUTHENTICATION` banner to confirm whether a given instance is currently open.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
ESPHome Device Builder Dashboard 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ESPHome Device Builder Dashboard是ESPHome组织开源的一个智能家居设备固件构建工具。 ESPHome Device Builder Dashboard 1.0.12之前版本存在授权问题漏洞，该漏洞源于仪表盘身份验证凭据的环境变量重命名后未保留旧变量回退，导致原先使用USERNAME和PASSWORD保护的实例在升级后失去身份验证，任何可访问其端口的攻击者均可未经授权访问。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
esphome device-builder < 1.0.12 -

II. Public POCs for CVE-2026-59178

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-59178

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-59178 (2)

Vendor Advisories for CVE-2026-59178 (1)

Vendor Pages for CVE-2026-59178 (1)

IV. Related Vulnerabilities

Same product: device-builder
Same vendor: esphome
Same weakness: CWE-306