{"schema":"threatline.record/2","record":{"id":"CVE-2026-59177","aliases":["GHSA-vv4j-m4vr-f3g6","PYSEC-2026-3834"],"summary":"ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces","details":"ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the `Home Assistant` host's LAN interface. Any device on that local network can therefore connect directly to the `ingress` port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through `external_components:`, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted `Home Assistant` configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10.","categories":["Libraries & packages"],"product":"device-builder","vendor":"esphome","ecosystem":"PyPI","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-59177","source_modified_at":"2026-10-28T13:12:14.620Z","fetched_at":"2026-10-28T15:55:58.673066Z","product":"device-builder","vendor":"esphome","versions":[{"version":"< 1.0.10","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vv4j-m4vr-f3g6","source_modified_at":"2026-09-10T12:26:07.204384996Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"name":"esphome-device-builder","ecosystem":"PyPI","purl":"pkg:pypi/esphome-device-builder"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10"}]}],"versions":["0.1.0b10","0.1.0b100","0.1.0b101","0.1.0b102","0.1.0b103","0.1.0b104","0.1.0b105","0.1.0b106","0.1.0b107","0.1.0b108","0.1.0b109","0.1.0b11","0.1.0b110","0.1.0b111","0.1.0b112","0.1.0b113","0.1.0b114","0.1.0b115","0.1.0b116","0.1.0b117","0.1.0b118","0.1.0b119","0.1.0b12","0.1.0b13","0.1.0b14","0.1.0b15","0.1.0b16","0.1.0b17","0.1.0b18","0.1.0b19","0.1.0b20","0.1.0b21","0.1.0b22","0.1.0b23","0.1.0b24","0.1.0b25","0.1.0b26","0.1.0b27","0.1.0b28","0.1.0b29","0.1.0b30","0.1.0b31","0.1.0b32","0.1.0b33","0.1.0b34","0.1.0b35","0.1.0b36","0.1.0b37","0.1.0b38","0.1.0b39"]}],"fixed_versions":[{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-vv4j-m4vr-f3g6","source_modified_at":"2026-09-10T12:26:07.204384996Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"name":"esphome-device-builder","ecosystem":"PyPI","purl":"pkg:pypi/esphome-device-builder"},"version":"1.0.10"}],"cvss":8.8,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T13:12:14.620Z","modified_at":"2026-10-28T13:12:14.620Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-59177","fetched_at":"2026-10-28T15:55:58.673066Z","source_modified_at":"2026-10-28T13:12:14.620Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-vv4j-m4vr-f3g6","fetched_at":"2026-10-28T15:55:58.673066Z","source_modified_at":"2026-09-10T12:26:07.204384996Z"},{"source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-59177.yaml","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":null}],"sources":["CVE List","OSV","Nuclei"],"references":[{"source":"CVE List","url":"https://github.com/esphome/device-builder/security/advisories/GHSA-vv4j-m4vr-f3g6","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/esphome/device-builder/pull/1565","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/esphome/device-builder/commit/b6387db3f8bf1d3df5771f40e9856b959ae4f6a1","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/esphome/device-builder/releases/tag/1.0.10","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","exploits":[{"kind":"Scanner template","name":"ESPHome Device Builder <1.0.10 - Unauthenticated Dashboard Access","source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-59177.yaml"}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T13:12:14.620Z","content_hash":"41d7289351b2a46c98563c17cceedd7f70e4ffb0efe845da1ca1a0219d2eec58"}}