The National Vulnerability Database published CVE-2026-59177 on October 28, 2026. It covers a flaw in ESPHome Device Builder, the dashboard behind the ESPHome add-on for Home Assistant, which let any device on the local network open the dashboard with no credentials. The bug is not new. ESPHome fixed it in June and published the advisory (GHSA-vv4j-m4vr-f3g6) on June 20. The CVE record is a good reason to check that no old installation is still around.

What went wrong

When the dashboard runs as a Home Assistant add-on, it serves an ingress site that skips authentication on purpose. The Supervisor's ingress proxy has already checked who you are, so the dashboard trusts requests coming through it. That only holds if the ingress site is reachable from the Supervisor alone.

It was not. The ingress site bound to 0.0.0.0, and the add-on uses host networking so that mDNS discovery works. Together that meant the site also listened on the Home Assistant host's LAN address. Anyone on the network could open http://<ha-ip>:<ingress_port>/ and get the full dashboard. No misconfiguration was needed: according to the advisory, the exposure was on by default in every host-network add-on install.

Why it rates 8.8

ESPHome's own threat model treats dashboard access as equivalent to host access. A user of the dashboard can run arbitrary Python at compile time through external_components:, run shell commands through the compile and validation steps, and read or write files in the config and data directories. The advisory spells out the result: full compromise of the add-on, including the Home Assistant config directory it mounts and the ESPHome devices it manages.

The CVSS 3.1 score is 8.8 with an adjacent attack vector: the attacker has to be on the local network, not the internet. The advisory names realistic ways in: a guest network that is not isolated, an untrusted IoT device or a compromised computer on the LAN.

Not affected: the standalone Docker dashboard and the password-protected port 6052.

The fix and what to check

Device Builder 1.0.10, released on June 18, binds the ingress site only to loopback (127.0.0.1) and the Supervisor gateway (172.30.32.1). A new peer guard also returns 403 to any connection that does not come from loopback or the Supervisor (172.30.32.2), so other add-ons on the internal network cannot use the site either. ESPHome 2026.6.1, released the same day, bundles that version, and later releases ship newer builds.

  • Check which version of the ESPHome add-on Home Assistant shows. Anything from 2026.6.1 onwards has the fix.
  • If you cannot update right away, block the add-on's ingress port on the host or router so only Home Assistant and the Supervisor can reach it. Opening the dashboard through the normal Home Assistant sidebar stays authenticated.
  • Keep the Home Assistant host off guest and IoT networks you do not trust.

Most installs that get regular updates have had the fix for over four months. The risk is in forgotten setups, such as a test machine or a host where updates were paused in June.