Authentication Bypass in ESPHome Device Builder Dashboard

CVE-2026-59178

What is CVE-2026-59178?

The ESPHome Device Builder Dashboard experienced an authentication bypass vulnerability due to the handling of environment variables for credentials. Earlier versions, including the legacy dashboard, relied on the $USERNAME and $PASSWORD environment variables, which were replaced by $ESPHOME_USERNAME and $ESPHOME_PASSWORD in version 1.0.12. The removal of the older variables without a fallback led to instances being exposed to unauthorized access after an upgrade. The maintainers have since implemented a solution in version 1.0.12, which restores the deprecated fallback to ensure that existing protected instances remain secure. Operators are encouraged to migrate to the new environment variable names while immediately addressing any exposed instances by resetting the new credentials. Furthermore, it's advised to restrict access to the dashboard port from untrusted networks and monitor the startup logs to verify authentication status.

References