# CVE-2026-59177: ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

Status: published. Published: 2026-10-28. Updated: 2026-11-02.

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the `Home Assistant` host's LAN interface. Any device on that local network can therefore connect directly to the `ingress` port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through `external_components:`, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted `Home Assistant` configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10.

## Remediation

- fix: esphome-device-builder (PyPI): OSV reports a fixed version 1.0.10. Check the advisory for supported release branches. (source: OSV GHSA-vv4j-m4vr-f3g6) — https://github.com/advisories/GHSA-vv4j-m4vr-f3g6

## Affected products and versions

- esphome / device-builder: < 1.0.10 (affected). Source: CNA: GitHub_M
-  / esphome-device-builder (esphome-device-builder): 0.1.0b10 (affected, PyPI); 0.1.0b100 (affected, PyPI); 0.1.0b101 (affected, PyPI); 0.1.0b102 (affected, PyPI); 0.1.0b103 (affected, PyPI); 0.1.0b104 (affected, PyPI); 0.1.0b105 (affected, PyPI); 0.1.0b106 (affected, PyPI); 0.1.0b107 (affected, PyPI); 0.1.0b108 (affected, PyPI); 0.1.0b109 (affected, PyPI); 0.1.0b11 (affected, PyPI); 0.1.0b110 (affected, PyPI); 0.1.0b111 (affected, PyPI); 0.1.0b112 (affected, PyPI); 0.1.0b113 (affected, PyPI); 0.1.0b114 (affected, PyPI); 0.1.0b115 (affected, PyPI); 0.1.0b116 (affected, PyPI); 0.1.0b117 (affected, PyPI); 0.1.0b118 (affected, PyPI); 0.1.0b119 (affected, PyPI); 0.1.0b12 (affected, PyPI); 0.1.0b13 (affected, PyPI); 0.1.0b14 (affected, PyPI); 0.1.0b15 (affected, PyPI); 0.1.0b16 (affected, PyPI); 0.1.0b17 (affected, PyPI); 0.1.0b18 (affected, PyPI); 0.1.0b19 (affected, PyPI); 0.1.0b20 (affected, PyPI); 0.1.0b21 (affected, PyPI); 0.1.0b22 (affected, PyPI); 0.1.0b23 (affected, PyPI); 0.1.0b24 (affected, PyPI); 0.1.0b25 (affected, PyPI); 0.1.0b26 (affected, PyPI); 0.1.0b27 (affected, PyPI); 0.1.0b28 (affected, PyPI); 0.1.0b29 (affected, PyPI); 0.1.0b30 (affected, PyPI); 0.1.0b31 (affected, PyPI); 0.1.0b32 (affected, PyPI); 0.1.0b33 (affected, PyPI); 0.1.0b34 (affected, PyPI); 0.1.0b35 (affected, PyPI); 0.1.0b36 (affected, PyPI); 0.1.0b37 (affected, PyPI); 0.1.0b38 (affected, PyPI); 0.1.0b39 (affected, PyPI); 0.1.0b40 (affected, PyPI); 0.1.0b41 (affected, PyPI); 0.1.0b42 (affected, PyPI); 0.1.0b43 (affected, PyPI); 0.1.0b44 (affected, PyPI); 0.1.0b45 (affected, PyPI); 0.1.0b46 (affected, PyPI); 0.1.0b47 (affected, PyPI); 0.1.0b48 (affected, PyPI); 0.1.0b49 (affected, PyPI); 0.1.0b50 (affected, PyPI); 0.1.0b51 (affected, PyPI); 0.1.0b52 (affected, PyPI); 0.1.0b53 (affected, PyPI); 0.1.0b54 (affected, PyPI); 0.1.0b55 (affected, PyPI); 0.1.0b56 (affected, PyPI); 0.1.0b57 (affected, PyPI); 0.1.0b58 (affected, PyPI); 0.1.0b59 (affected, PyPI); 0.1.0b60 (affected, PyPI); 0.1.0b61 (affected, PyPI); 0.1.0b62 (affected, PyPI); 0.1.0b63 (affected, PyPI); 0.1.0b64 (affected, PyPI); 0.1.0b65 (affected, PyPI); 0.1.0b66 (affected, PyPI); 0.1.0b67 (affected, PyPI); 0.1.0b68 (affected, PyPI); 0.1.0b69 (affected, PyPI); 0.1.0b70 (affected, PyPI); 0.1.0b71 (affected, PyPI); 0.1.0b72 (affected, PyPI); 0.1.0b73 (affected, PyPI); 0.1.0b74 (affected, PyPI); 0.1.0b75 (affected, PyPI); 0.1.0b76 (affected, PyPI); 0.1.0b77 (affected, PyPI); 0.1.0b78 (affected, PyPI); 0.1.0b79 (affected, PyPI); 0.1.0b80 (affected, PyPI); 0.1.0b81 (affected, PyPI); 0.1.0b82 (affected, PyPI); 0.1.0b83 (affected, PyPI); 0.1.0b84 (affected, PyPI); 0.1.0b85 (affected, PyPI); 0.1.0b86 (affected, PyPI); 0.1.0b87 (affected, PyPI); 0.1.0b88 (affected, PyPI); 0.1.0b89 (affected, PyPI); 0.1.0b90 (affected, PyPI); 0.1.0b91 (affected, PyPI); 0.1.0b92 (affected, PyPI); 0.1.0b93 (affected, PyPI); 0.1.0b94 (affected, PyPI); 0.1.0b95 (affected, PyPI); 0.1.0b96 (affected, PyPI); 0.1.0b97 (affected, PyPI); 0.1.0b98 (affected, PyPI); 0.1.0b99 (affected, PyPI); 1.0.0 (affected, PyPI); 1.0.1 (affected, PyPI); 1.0.10b1 (affected, PyPI); 1.0.10b2 (affected, PyPI); 1.0.2b1 (affected, PyPI); 1.0.2b2 (affected, PyPI); 1.0.2b3 (affected, PyPI); 1.0.2b4 (affected, PyPI); 1.0.3 (affected, PyPI); 1.0.4 (affected, PyPI); 1.0.5 (affected, PyPI); 1.0.6 (affected, PyPI); 1.0.7 (affected, PyPI); 1.0.8 (affected, PyPI); 1.0.9 (affected, PyPI); Ecosystem version events: introduced 0; fixed 1.0.10. Source: OSV GHSA-vv4j-m4vr-f3g6

## Severity and prioritization

- CVSS 3.1: 8.8 (high); CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: 1.17% as of 2026-11-02; percentile 67.37%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-1327

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/esphome/device-builder/security/advisories/GHSA-vv4j-m4vr-f3g6 (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/esphome/device-builder/pull/1565 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/esphome/device-builder/commit/b6387db3f8bf1d3df5771f40e9856b959ae4f6a1 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/esphome/device-builder/releases/tag/1.0.10 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/advisories/GHSA-vv4j-m4vr-f3g6 (OSV / GitHub Security Advisories; advisory)

- https://osv.dev/vulnerability/GHSA-vv4j-m4vr-f3g6 (OSV / GitHub Security Advisories; osv)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-59177; retrieved 2026-11-02; source updated 2026-11-02

- OSV / GitHub Security Advisories: https://osv.dev/vulnerability/GHSA-vv4j-m4vr-f3g6; retrieved 2026-11-02; source updated 2026-09-10

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-59177; retrieved 2026-11-02; source updated Not reported

Revision: 21c303e14208aee6d0c42d8360a219f48a5cfa1f654126241c168f819b0421fc

Canonical: https://y2.dev/cve/CVE-2026-59177

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.