Live › vulnerability › CVE-2026-59177
Go to dashboardThe ESPHome dashboard shipped as a Home Assistant add-on binds an unauthenticated ingress site to all interfaces, so any device on the LAN can reach it. An attacker who reaches it can run Python and shell commands through the build process and read or change configuration and managed devices.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 14:33 UTC. All times on this page are UTC.
Users running the ESPHome Device Builder as the Home Assistant add-on on a host with host networking, which the add-on needs for mDNS, so the unauthenticated ingress site is exposed on the LAN. The standalone Docker dashboard and the password-gated public port 6052 are not affected according to the sources.
No product ranges from the sources yet.
1.0.10.1.0.10 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the Home Assistant add-on's trusted ingress site binds to 0.0.0.0 while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the Home Assistant host's LAN interface. Any device on that local network can therefore connect directly to the ingress port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through external_components:, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted Home Assistant configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10.
This page as .md · .json · in your agent: get_signal("CVE-2026-59177")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.