If an ESPHome device forwards its logs to a syslog server, that server may have been receiving the device's passwords. A fix by Jonathan Swoboda, merged into ESPHome's development branch on 23 October 2026, replaces those values with [redacted] before the log line leaves the device. It is not in the 2026.10.0 release from 21 October, so it should arrive with ESPHome 2026.11.

Hidden on screen, present on the wire

ESPHome marks sensitive values in its logs with a LOG_SECRET() helper. The helper does not remove anything. It wraps the value in ANSI "conceal" escape codes, so a terminal hides the text while the bytes stay in the log line.

That is harmless on a serial console. The syslog component, however, forwarded each line over UDP exactly as it was. Its strip option removes only the colour code at the start of a line and the reset at the end, not the concealed text in between. According to the pull request, a syslog collector, or anyone able to capture traffic between the device and the collector, received:

  • the Wi-Fi password;
  • the MQTT password;
  • the WireGuard private key;
  • the password submitted through the captive portal's /wifisave page.

Some of these are printed by dump_config, so they went out on every boot.

What the fix does

The component now scans each message and swaps every concealed region for the literal text [redacted] before the message goes into the syslog packet. This happens whether strip is on or off. A wifi: block with a password therefore reaches the collector as Password: [redacted].

The change adds no heap allocation or extra buffer, and the message still fits the existing 508-byte packet. Lines without an escape character, which is almost all of them, take a faster path than before. Five new unit tests cover plain lines, one and several secrets, an unterminated marker and a message that hits the buffer limit.

The pull request lists this as finding 3.4 of ESPHome's 2026 security assessment.

What to do now

Only devices with a syslog: block are affected. Until 2026.11 is out, anyone who forwards logs from such devices should treat the collector's stored logs as containing those passwords: limit who can read them and consider deleting old entries. Once the update is installed, it is worth changing the Wi-Fi and MQTT passwords if the logs went to a shared or remote server.