ESPHome Device Builder Dashboard: Unauthenticated dashboard access

Published September 9, 2026 CVE-2026-59177

ESPHome Device Builder could expose its Home Assistant dashboard without a login. Anyone on the same local network could access its full dashboard and read or change mounted configuration files.

Severity
HighCVSS 8.8
Fix
Fixed in 1.0.10Fix recorded yesterday
Affected versions
before 1.0.10
Affects
esphome-device-builder

How it works

  • The Home Assistant add-on's dashboard relied on the supervisor to authenticate visitors.
  • It listened on every network interface, including the Home Assistant host's LAN address.
  • A device on that network could therefore reach the dashboard directly and bypass the supervisor's login protection.

What to do

Run python3 -m pip show esphome-device-builder in the environment running the add-on. A version below 1.0.10 is in scope; this check does not cover bundled copies or other Home Assistant installations.

Run this in the application environment you want to check:

python3 -m pip show esphome-device-builder

Update the Home Assistant add-on so it includes esphome-device-builder 1.0.10 or newer. Until then, restrict the add-on's ingress port to the Home Assistant host and supervisor using a network-layer rule, following the security advisory.

Technical details

CVE-2026-59177 affected the Home Assistant add-on's unauthenticated ingress listener. versions older than 1.0.10 exposed it on all interfaces; the fix limits access to loopback and the supervisor gateway, with an additional peer check.

References

View Original Source