CVE-2026-59178: ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade
The dashboard reads its authentication credentials from $ESPHOME_USERNAME and $ESPHOME_PASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who had protected their dashboard with USERNAME / PASSWORD (as the older getting started guide documented) loses authentication on upgrade and the dashboard starts open to anyone who can reach its port.
References
- github.com/advisories/GHSA-rrxg-g2pf-6hh4
- github.com/esphome/device-builder/commit/9e294f729c3eb7334bb57b9fc49b75b728052f52
- github.com/esphome/device-builder/pull/1625
- github.com/esphome/device-builder/releases/tag/1.0.12
- github.com/esphome/device-builder/security/advisories/GHSA-rrxg-g2pf-6hh4
- nvd.nist.gov/vuln/detail/CVE-2026-59178
Code Behaviors & Features
Detect and mitigate CVE-2026-59178 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →