Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-59178— ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

Quick assessment

Affected
esphome device-builder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ESPHome Device Builder 仪表板（Dashboard）是 ESPHome 智能家居管理软件的配套仪表板。在 1.0.12 版本之前，该仪表板从环境变量 和 读取认证凭据。而在更早的版本中，以及传统的 仪表板，读取的是简写的 和 。 当环境变量更名时，旧有的简写名称被移除且未设置回退机制。因此，那些按照旧版入门指南使用 / 来保护仪表板的运维人员在升级后会失去认证功能，导致仪表板端口对所有能访问该端口的人开放。 该问题已在 1.0.12 版本中修复。修复后的版本重新接受简写的 / 作为已弃用的回退

CVSS 9.8 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
esphome device-builder < 1.0.12 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-59178

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade
Source: CVE Program / CVE List V5
Vulnerability Description
ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from `$ESPHOME_USERNAME` and `$ESPHOME_PASSWORD`. Earlier versions, and the legacy `esphome` dashboard, read the bare `$USERNAME` and `$PASSWORD` instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who had protected their dashboard with `USERNAME` / `PASSWORD` (as the older getting started guide documented) loses authentication on upgrade and the dashboard starts open to anyone who can reach its port. The issue is fixed in 1.0.12. The bare `$USERNAME` / `$PASSWORD` are accepted again as a deprecated fallback so previously protected instances stay protected across the upgrade without operator intervention, with a loud deprecation warning at startup directing operators to rename them to `$ESPHOME_USERNAME` / `$ESPHOME_PASSWORD`. The fallback is gated on `$PASSWORD` being set and is only adopted as a pair, so the OS provided `$USERNAME` is never read on its own and the original collision footgun stays closed. A lone bare `$PASSWORD` with no username still fails loud as a credential mismatch rather than starting unauthenticated. This restores compatibility rather than failing closed on the legacy names, because the priority is that an instance which was protected before the upgrade stays protected without the operator having to act; the deprecation warning plus a future removal handles the migration. Operators should migrate to the `$ESPHOME_*` names. The esphome container delivers the fix in the 2026.6.2 release, which bumps its pinned `esphome-device-builder` version to 1.0.12. Without upgrading, restore authentication immediately by setting the new env vars to the same values, on any affected version. Alternatively, do not expose the dashboard port to untrusted networks, and check the startup logs for the `WITHOUT AUTHENTICATION` banner to confirm whether a given instance is currently open.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
esphome device-builder < 1.0.12 -

II. Public POCs for CVE-2026-59178

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-59178

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-59178 (2)

Vendor Advisories for CVE-2026-59178 (1)

Vendor Pages for CVE-2026-59178 (1)

IV. Related Vulnerabilities

Same vendor: esphome
Same weakness: CWE-306

V. Comments for CVE-2026-59178

No comments yet

Leave a comment