CVE-2026-59178

Name of the Vulnerable Software and Affected Versions ESPHome Device Builder Dashboard versions prior to 1.0.12 esphome container versions prior to 2026.6.2

Description An authentication bypass occurs when upgrading the dashboard because the system stopped supporting the legacy $USERNAME and $PASSWORD environment variables without providing a fallback. Operators who relied on these variables find their dashboard starting without authentication, leaving it open to any user with network access to the dashboard port. This allows unauthenticated clients to manage devices, edit configurations, and flash firmware. The issue is triggered within the DashboardSettings.parse args function. In the esphome container, this affects the standalone Docker path where the dashboard subcommand is used, but does not affect Home Assistant add-on installations.

Recommendations Update ESPHome Device Builder Dashboard to version 1.0.12 or newer. Update the esphome container to version 2026.6.2 or newer. As a temporary workaround, set the $ESPHOME USERNAME and $ESPHOME PASSWORD environment variables to the desired values on any affected version. Restrict access to the dashboard port to trusted networks only. Check startup logs for the WITHOUT AUTHENTICATION banner to verify if the instance is exposed.