{"id":"CVE-2026-59177","kind":"vulnerability","aliases":["CVE-2026-59177"],"related":[],"title":"ESPHome Device Builder: LAN devices bypass auth on Home Assistant add-on","description":"ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the `Home Assistant` host's LAN interface. Any device on that local network can therefore connect directly to the `ingress` port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through `external_components:`, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted `Home Assistant` configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10.","summary":"The ESPHome dashboard shipped as a Home Assistant add-on binds an unauthenticated ingress site to all interfaces, so any device on the LAN can reach it. An attacker who reaches it can run Python and shell commands through the build process and read or change configuration and managed devices.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["esphome","home-assistant","iot","package","self-hosted"],"not_affected_if":["password-protected-port-6052","standalone-docker","updated-to-1.0.10"],"how_to_check":"- Check the ESPHome Device Builder add-on version in Home Assistant under Settings, Add-ons, ESPHome Device Builder, and confirm it is below `1.0.10`.\n- Check whether the add-on runs with host networking, which is required for mDNS and is the default for this add-on.\n- From another device on the same LAN, try to connect to the add-on's ingress port; a reachable dashboard without a login means exposure.","fix":"- Update the ESPHome Device Builder Home Assistant add-on to `1.0.10` or later.\n- Until updated, limit access to the ingress port with a firewall or by isolating IoT devices from the Home Assistant host's LAN interface.","status":"open","published_at":"2026-10-28T14:17:04+00:00","first_seen_at":"2026-10-28T14:33:23+00:00","triaged_at":"2026-10-28T14:34:16+00:00","updated_at":"2026-10-28T14:34:16+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T14:34:16Z","model":"claude-haiku-5-5","output":{"fix":"- Update the ESPHome Device Builder Home Assistant add-on to `1.0.10` or later.\n- Until updated, limit access to the ingress port with a firewall or by isolating IoT devices from the Home Assistant host's LAN interface.","reach":"network","title":"ESPHome Device Builder: LAN devices bypass auth on Home Assistant add-on","impact":"high","summary":"The ESPHome dashboard shipped as a Home Assistant add-on binds an unauthenticated ingress site to all interfaces, so any device on the LAN can reach it. An attacker who reaches it can run Python and shell commands through the build process and read or change configuration and managed devices.","category":"package","nicknames":[],"who_cares":["esphome","home-assistant","self-hosted","iot"],"confidence":0.8,"needs_auth":"no","worst_case":"LAN attacker runs code on the Home Assistant host and reads configuration","analyst_note":"","how_to_check":"- Check the ESPHome Device Builder add-on version in Home Assistant under Settings, Add-ons, ESPHome Device Builder, and confirm it is below `1.0.10`.\n- Check whether the add-on runs with host networking, which is required for mDNS and is the default for this add-on.\n- From another device on the same LAN, try to connect to the add-on's ingress port; a reachable dashboard without a login means exposure.","needs_analyst":false,"not_affected_if":["standalone-docker","password-protected-port-6052","updated-to-1.0.10"],"who_is_affected":"Users running the ESPHome Device Builder as the Home Assistant add-on on a host with host networking, which the add-on needs for mDNS, so the unauthenticated ingress site is exposed on the LAN. The standalone Docker dashboard and the password-gated public port 6052 are not affected according to the sources.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000691,"input_tokens":3547,"output_tokens":672,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-59177':15A,18A '0.0.0.0':107C '1.0.10':94C,226C '6052':216C 'access':189C 'add':12A,37B,99C 'add-on':11A,36B,98C 'affect':219C 'also':127C 'arbitrari':188C 'assist':10A,22B,35B,97C,137C,199C 'attack':57B 'auth':7A,132C 'authent':112C,119C 'bind':39B,105C,128C 'build':69B 'builder':3A,81C 'bypass':6A,156C 'capabl':170C 'chang':74B 'command':66B 'compil':173C,183C 'compile-tim':172C 'compon':179C 'compromis':195C 'configur':75B,191C,200C 'connect':150C 'credenti':165C 'cve':13A,16A 'dashboard':30B,82C,85C,111C,163C,169C,208C 'data':193C 'devic':2A,5A,49B,78B,80C,143C,204C 'direct':151C 'docker':207C 'esphom':1A,19B,29B,79C,88C,203C 'execut':176C,181C 'expect':117C 'extern':178C 'file':194C 'fix':223C 'full':162C 'gate':213C 'home':9A,21B,34B,89C,96C,136C,198C 'home-assist':20B 'host':27B,122C,138C 'includ':171C 'ingress':42B,103C,154C 'intent':109C 'interfac':46B,141C 'iot':23B 'issu':221C 'lan':4A,52B,140C 'local':146C 'manag':77B,90C,202C 'mdns':126C 'misconfigur':168C 'mount':197C 'network':123C,147C 'no-auth':130C 'obtain':160C 'oper':167C 'packag':24B 'password':212C 'password-g':211C 'port':155C,215C 'prior':92C 'process':70B 'public':214C 'python':63B,175C 'reach':54B,59B 'read':72B 'request':120C 'requir':124C 'run':62B 'self':26B 'self-host':25B 'shell':65B,180C 'ship':31B 'site':43B,104C,133C 'skip':110C 'softwar':91C 'standalon':206C 'subprocess':186C 'supervisor':115C,158C 'therefor':149C 'time':174C 'trust':102C 'unauthent':41B 'upstream':121C 'valid':185C 'version':225C 'without':164C","nicknames":[],"mitigations":[],"who_affected":"Users running the ESPHome Device Builder as the Home Assistant add-on on a host with host networking, which the add-on needs for mDNS, so the unauthenticated ingress site is exposed on the LAN. The standalone Docker dashboard and the password-gated public port 6052 are not affected according to the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T14:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59177","severity":null,"published_at":"2026-10-28T14:17:04+00:00","modified_at":"2026-10-28T14:17:04+00:00","first_seen_at":"2026-10-28T14:33:23+00:00","fetched_at":"2026-10-28T14:33:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}