CVE-2026-59178: ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade
The dashboard reads its authentication credentials from $ESPHOME_USERNAME and $ESPHOME_PASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who had protected their dashboard with USERNAME / PASSWORD (as the older getting started guide documented) loses authentication on upgrade and the dashboard starts open to anyone who can reach its port.
References
- github.com/advisories/GHSA-rrxg-g2pf-6hh4
- github.com/esphome/device-builder/commit/9e294f729c3eb7334bb57b9fc49b75b728052f52
- github.com/esphome/device-builder/pull/1625
- github.com/esphome/device-builder/releases/tag/1.0.12
- github.com/esphome/device-builder/security/advisories/GHSA-rrxg-g2pf-6hh4
- nvd.nist.gov/vuln/detail/CVE-2026-59178
Code Behaviors & Features
Detect and mitigate CVE-2026-59178 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →