CVE-2026-71260— ESPHome web_server Plaintext Password Disclosure via JSON "value" Field
Possible ATT&CK Techniques 1AI
T1005 · Data from Local SystemGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-71260
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ESPHome web_server Plaintext Password Disclosure via JSON "value" Field
Source: CVE Program / CVE List V5
Vulnerability Description
ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON "state" field correctly masked as "********", but the same serialization path unconditionally writes the raw password into the JSON "value" field via set_json_icon_state_value/set_json_value.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5
Vulnerability Title
ESPHome 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ESPHome是ESPHome组织开源的一款智能家居设备控制平台。 ESPHome 2026.7.0-dev及之前版本存在信任管理问题漏洞，该漏洞源于web_server组件在序列化文本实体时将明文密码写入JSON的value字段，可能导致本地网络攻击者获取WiFi凭据、API令牌等明文密码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-71260
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-71260
请登录查看更多情报信息。
Vendor Pages for CVE-2026-71260 (1)
IV. Related Vulnerabilities
Same product: esphome
- CVE-2026-71259
ESPHome external_components file:// Scheme Validation Bypass - CVE-2026-23833
ESPHome vulnerable to denial-of-service via out-of-bounds ch - CVE-2025-57808
ESP-IDF web_server basic auth bypass using empty or incomple - CVE-2024-29019
ESPHome vulnerable to Authentication bypass via Cross site r - CVE-2024-27287
ESPHome vulnerable to stored Cross-site Scripting in edit co
Same vendor: esphome
- CVE-2026-71259
ESPHome external_components file:// Scheme Validation Bypass - CVE-2026-23833
ESPHome vulnerable to denial-of-service via out-of-bounds ch - CVE-2025-57808
ESP-IDF web_server basic auth bypass using empty or incomple - CVE-2024-29019
ESPHome vulnerable to Authentication bypass via Cross site r - CVE-2024-27287
ESPHome vulnerable to stored Cross-site Scripting in edit co
Same weakness: CWE-522
- CVE-2026-72857
Budibase before 3.40.0 Credential Exposure via STRING Fields - CVE-2026-0290
Prisma Browser: Sensitive Information Disclosure Vulnerabili - CVE-2026-0289
Prisma Browser: Inappropriate Implementation in Account Prot - CVE-2026-72801
SiYuan before v3.7.4 Information Disclosure via Encryption K - CVE-2026-72794
siyuan before v3.7.4 Session Cookie Key Disclosure via getCo
V. Comments for CVE-2026-71260
No comments yet