Vulnerability in ESPHome Device Builder Dashboard affecting Home Assistant add-on
CVE-2026-59177

8.8HIGH

Key Information:

Vendor

Esphome

Status
Device-builder
Vendor
CVE Published:
28 October 2026

What is CVE-2026-59177?

The ESPHome Device Builder Dashboard has a significant vulnerability affecting the Home Assistant add-on. In versions prior to 1.0.10, the trusted ingress site binds to 0.0.0.0 and skips authentication, allowing any device on the local network to connect without credentials. This bypass exposes sensitive dashboard capabilities, including the execution of arbitrary Python code and access to critical configuration files, potentially compromising Home Assistant setups and connected ESPHome devices. The standalone Docker version is unaffected, and the issue has been resolved in version 1.0.10.

Affected Version(s)

device-builder < 1.0.10

References

https://github.com/esphome/device-builder/security/adviso...
x_refsource_CONFIRM
https://github.com/esphome/device-builder/pull/1565
x_refsource_MISC
https://github.com/esphome/device-builder/commit/b6387db3...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.