Plaintext Password Exposure in ESPHome Web Server by Espressif Systems

CVE-2026-71260

What is CVE-2026-71260?

ESPHome versions up to 2026.7.0-dev have a vulnerability in their web_server component where plaintext passwords are disclosed. Although the JSON response masks the password in the 'state' field, the raw password is still written unconditionally in the 'value' field. Since the web server operates without authentication on port 80 by default, attackers within the local network can exploit this flaw to retrieve sensitive credentials, such as WiFi passwords and API tokens, using specific GET requests.

References