---
id: "CVE-2026-59177"
kind: "vulnerability"
aliases: ["CVE-2026-59177"]
title: "ESPHome Device Builder: LAN devices bypass auth on Home Assistant add-on"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["esphome", "home-assistant", "iot", "package", "self-hosted"]
not_affected_if: ["password-protected-port-6052", "standalone-docker", "updated-to-1.0.10"]
published_at: "2026-10-28T14:17:04+00:00"
first_seen_at: "2026-10-28T14:33:23+00:00"
updated_at: "2026-10-28T14:34:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59177", "first_seen_at": "2026-10-28T14:33:23+00:00"}]
---

# ESPHome Device Builder: LAN devices bypass auth on Home Assistant add-on

The ESPHome dashboard shipped as a Home Assistant add-on binds an unauthenticated ingress site to all interfaces, so any device on the LAN can reach it. An attacker who reaches it can run Python and shell commands through the build process and read or change configuration and managed devices.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the ESPHome Device Builder add-on version in Home Assistant under Settings, Add-ons, ESPHome Device Builder, and confirm it is below `1.0.10`.
- Check whether the add-on runs with host networking, which is required for mDNS and is the default for this add-on.
- From another device on the same LAN, try to connect to the add-on's ingress port; a reachable dashboard without a login means exposure.

## Fix

- Update the ESPHome Device Builder Home Assistant add-on to `1.0.10` or later.
- Until updated, limit access to the ingress port with a firewall or by isolating IoT devices from the Home Assistant host's LAN interface.

## Timeline

- 2026-10-28T14:33:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59177

## From the sources

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the `Home Assistant` host's LAN interface. Any device on that local network can therefore connect directly to the `ingress` port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through `external_components:`, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted `Home Assistant` configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_