All vulnerabilities
CVE-2026-59177GHSA-vv4j-m4vr-f3g6PYSEC-2026-3834

device-builder: ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

esphome device-builderPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationScanner template publicA Nuclei template detects it. Not in the KEV catalogNuclei
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in1.0.10Fixed versionOSV
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 1.0.10esphome-device-builder, PyPIOSVpip install "esphome-device-builder>=1.0.10"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Public exploit code and templates 1

  • Scanner templateESPHome Device Builder <1.0.10 - Unauthenticated Dashboard AccessNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the Home Assistant add-on's trusted ingress site binds to 0.0.0.0 while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the Home Assistant host's LAN interface. Any device on that local network can therefore connect directly to the ingress port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through external_components:, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted Home Assistant configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10.

Text from CVE List

Affected versions 52

  • device-builderaffected: < 1.0.10CVE List
  • esphome-device-builder, PyPIfrom first release, fixed in 1.0.10OSV
  • esphome-device-builder, PyPI0.1.0b10OSV
  • esphome-device-builder, PyPI0.1.0b100OSV
  • esphome-device-builder, PyPI0.1.0b101OSV
  • esphome-device-builder, PyPI0.1.0b102OSV
  • esphome-device-builder, PyPI0.1.0b103OSV
  • esphome-device-builder, PyPI0.1.0b104OSV
  • esphome-device-builder, PyPI0.1.0b105OSV
  • esphome-device-builder, PyPI0.1.0b106OSV
  • esphome-device-builder, PyPI0.1.0b107OSV
  • esphome-device-builder, PyPI0.1.0b108OSV
  • esphome-device-builder, PyPI0.1.0b109OSV
  • esphome-device-builder, PyPI0.1.0b11OSV
  • esphome-device-builder, PyPI0.1.0b110OSV
  • esphome-device-builder, PyPI0.1.0b111OSV
  • esphome-device-builder, PyPI0.1.0b112OSV
  • esphome-device-builder, PyPI0.1.0b113OSV
  • esphome-device-builder, PyPI0.1.0b114OSV
  • esphome-device-builder, PyPI0.1.0b115OSV
  • esphome-device-builder, PyPI0.1.0b116OSV
  • esphome-device-builder, PyPI0.1.0b117OSV
  • esphome-device-builder, PyPI0.1.0b118OSV
  • esphome-device-builder, PyPI0.1.0b119OSV
  • esphome-device-builder, PyPI0.1.0b12OSV
  • esphome-device-builder, PyPI0.1.0b13OSV
  • esphome-device-builder, PyPI0.1.0b14OSV
  • esphome-device-builder, PyPI0.1.0b15OSV
  • esphome-device-builder, PyPI0.1.0b16OSV
  • esphome-device-builder, PyPI0.1.0b17OSV
  • esphome-device-builder, PyPI0.1.0b18OSV
  • esphome-device-builder, PyPI0.1.0b19OSV
  • esphome-device-builder, PyPI0.1.0b20OSV
  • esphome-device-builder, PyPI0.1.0b21OSV
  • esphome-device-builder, PyPI0.1.0b22OSV
  • esphome-device-builder, PyPI0.1.0b23OSV
  • esphome-device-builder, PyPI0.1.0b24OSV
  • esphome-device-builder, PyPI0.1.0b25OSV
  • esphome-device-builder, PyPI0.1.0b26OSV
  • esphome-device-builder, PyPI0.1.0b27OSV
  • esphome-device-builder, PyPI0.1.0b28OSV
  • esphome-device-builder, PyPI0.1.0b29OSV
  • esphome-device-builder, PyPI0.1.0b30OSV
  • esphome-device-builder, PyPI0.1.0b31OSV
  • esphome-device-builder, PyPI0.1.0b32OSV
  • esphome-device-builder, PyPI0.1.0b33OSV
  • esphome-device-builder, PyPI0.1.0b34OSV
  • esphome-device-builder, PyPI0.1.0b35OSV
  • esphome-device-builder, PyPI0.1.0b36OSV
  • esphome-device-builder, PyPI0.1.0b37OSV
  • esphome-device-builder, PyPI0.1.0b38OSV
  • esphome-device-builder, PyPI0.1.0b39OSV

References 4