CVE-2026-59177: ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

September 9, 2026

On the Home Assistant add-on, the dashboard serves a trusted ingress site that skips authentication because the supervisor authenticates the request upstream. That site was binding 0.0.0.0. The add-on runs in host network mode for mDNS, so binding all interfaces also bound the host’s LAN interface, and any device on the local network could reach http://<ha-ip>:<ingress_port>/ and get the full dashboard with no credentials.

References

github.com/advisories/GHSA-vv4j-m4vr-f3g6
github.com/esphome/device-builder/commit/b6387db3f8bf1d3df5771f40e9856b959ae4f6a1
github.com/esphome/device-builder/pull/1565
github.com/esphome/device-builder/security/advisories/GHSA-vv4j-m4vr-f3g6
nvd.nist.gov/vuln/detail/CVE-2026-59177

Code Behaviors & Features

Detect and mitigate CVE-2026-59177 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →