Junglewise Threat Intelligence

CVE-2026-59177: ESPHome Device Builder auth bypass via unrestricted ingress binding

CVE-2026-59177 · Severity: high · CVSS 8.8 · Published 2026-09-09

Executive brief

The ESPHome Device Builder dashboard in Home Assistant add-ons was accessible without authentication over the local network due to binding to all network interfaces (0.0.0.0) instead of restricted endpoints. Any device on the same network could reach the dashboard with no credentials and gain full control, including ability to run arbitrary code, modify configuration files, and compromise managed ESPHome devices. This vulnerability exposed Home Assistant installations by default with no configuration required by the user.

Technical details

The vulnerability is an authentication bypass caused by improper network binding (CWE-1327). The ingress site was designed to rely on the Home Assistant supervisor's upstream authentication proxy and was intentionally unauthenticated, with the threat model assuming access only through the supervisor's internal Docker network. However, the application bound to 0.0.0.0 instead of loopback and the supervisor gateway (127.0.0.1 and 172.30.32.1). Since the add-on runs in host network mode, this binding exposed the site on the host's LAN interface, allowing unauthenticated access from any adjacent network device without going through the supervisor's authentication. An unauthenticated attacker can run arbitrary Python code at compile time via external_components, execute shell commands during compilation, and read/write files in the config and data directories. The fix (v1.0.10) restricts binding to loopback and supervisor gateway only, and adds a peer guard that rejects non-authorized TCP connections. The public port 6052 with password protection is not affected.

Affected products

  • ESPHome Device Builder < 1.0.10

Timeline

  • 2026-06-20: disclosed: GHSA-vv4j-m4vr-f3g6 published by GitHub Security Advisory
  • 2026-06-20: patched: Fixed in device-builder 1.0.10 (PR #1565)
  • 2026-09-09: advisory: Updated and finalized advisory in GitHub Advisory Database

References

Related threats