CVE-2026-71260

Name of the Vulnerable Software and Affected Versions ESPHome versions prior to 2026.7.0-dev

Description The web server component discloses plaintext passwords. In the WebServer::text json () function, text entities configured with mode: password have their JSON state field masked, but the raw password is written into the JSON value field through set json icon state value() and set json value(). Since the web server listens on port 80 without authentication by default, an attacker on the local network can retrieve sensitive information, such as WiFi credentials or API tokens, via the GET /text/<entity id> endpoint or the /events EventSource stream.

Recommendations Update to a version later than 2026.7.0-dev. As a temporary mitigation, restrict access to the web server component or avoid using the mode: password configuration for text entities.