CVE-2026-591778.8HighCWE-1327

CVE-2026-59177: ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

esphome · device-builder

Affected: esphome device-builder · Exploitation: check available, not yet exploited

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

1.2%probability of exploitation in the next 30 days

67th percentile

050100

Higher than 67% of scored CVEs

8.8HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the `Home Assistant` host's LAN interface. Any device on that local network can therefore connect directly to the `ingress` port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through `external_components:`, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted `Home Assistant` configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

esphome · device-builder< 1.0.10

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
CISA KEV: Not listed
Public check: ESPHome Device Builder <1.0.10 - Unauthenticated Dashboard Access · nuclei template in projectdiscovery/nuclei-templates
Weakness: Binding to an Unrestricted IP Address · Access Control
Vendor: esphome
Published: October 2026
Band: Check available, not yet exploited, October 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-59177 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.