/Vulnerability Library

ESPHome Device Builder <1.0.10 - Unauthenticated Dashboard Access

CVE-2026-59177
Verified

Description

ESPHome Device Builder versions before 1.0.10 bind the trusted Home Assistant ingress site to all interfaces. A client that can reach the ingress port can therefore access the dashboard without the Supervisor's authentication proxy.

Severity

High

CVSS Score

8.8

Affected Product

device-builder

Published Date

September 11, 2026

Template Author

str4k3r

CVE-2026-59177.yaml
8.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-59177
CWE ID:
cwe-306

References

https://github.com/esphome/device-builder/security/advisories/GHSA-vv4j-m4vr-f3g6https://nvd.nist.gov/vuln/detail/CVE-2026-59177https://github.com/esphome/device-builder/pull/1565https://github.com/esphome/device-builder/commit/b6387db3f8bf1d3df5771f40e9856b959ae4f6a1

Remediation Steps

Upgrade the ESPHome add-on to a release bundling Device Builder 1.0.10 or later.