CVE-2026-59177

Name of the Vulnerable Software and Affected Versions ESPHome Device Builder versions prior to 1.0.10

Description In the Home Assistant add-on, the dashboard serves a trusted ingress site that skips authentication, relying on the supervisor to authenticate requests upstream. However, the site binds to 0.0.0.0, and because the add-on uses host networking for mDNS, the no-auth site is exposed on the host's LAN interface. This allows any device on the local network to connect directly to the ingress port and bypass authentication to access the full dashboard. An attacker with dashboard access can execute arbitrary Python code at compile time via external components:, perform shell execution through compile and validation subprocesses, and gain arbitrary access to configuration and data files, leading to a full compromise of the add-on, the mounted Home Assistant configuration, and managed ESPHome devices.

Recommendations Update ESPHome Device Builder to version 1.0.10 or newer. As a temporary workaround, restrict access to the add-on's ingress port at the network layer using a host or router firewall rule to allow only the Home Assistant host and the supervisor to reach it.