CVE-2026-59177: 
Python vulnerability analysis and mitigation

CVE-2026-59177 is an authentication bypass vulnerability in the ESPHome Device Builder Home Assistant add-on, caused by the trusted ingress dashboard site binding to all network interfaces (0.0.0.0) instead of only the supervisor's internal network. Because the add-on runs in host network mode (for mDNS), this exposed the unauthenticated ingress dashboard directly on the host's LAN interface, allowing any device on the local network to access the full dashboard without credentials. It affects esphome-device-builder (pip) versions prior to 1.0.10, and was first fixed on June 18, 2026 (PR #1565), with the advisory published on June 20, 2026 and added to the GitHub Advisory Database on September 9, 2026. The CVSS v3.1 base score is 8.8 (High) (GitHub Advisory, ESPHome Advisory).

The root cause is classified as CWE-1327 (Binding to an Unrestricted IP Address): the trusted HA ingress site was started with resolve_bind_host(settings.ingress_host or "0.0.0.0"), defaulting to all interfaces. The ingress site is intentionally unauthenticated — the Home Assistant supervisor's ingress proxy is supposed to authenticate requests upstream, with the security boundary enforced by physically binding the site only to the supervisor's internal Docker network. However, because the ESPHome add-on uses host networking for mDNS, binding 0.0.0.0 also bound the host's LAN interface, making the no-auth dashboard reachable directly from the LAN without passing through the supervisor. The fix (PR #1565) changes the default bind to 127.0.0.1 and 172.30.32.1 (supervisor gateway only), and adds an ingress_peer_guard middleware that returns HTTP 403 to any TCP peer other than loopback (127.0.0.1, ::1) or the supervisor (172.30.32.2), mirroring the legacy add-on's nginx allow/deny ACL (GitHub Advisory, Fix Commit).

Any device on the same local network as the Home Assistant host — including untrusted IoT devices, guest network clients, or compromised local hosts — could access the full ESPHome dashboard with no credentials required. Per ESPHome's documented threat model, an authenticated dashboard caller has host-equivalent capability: they can execute arbitrary Python at compile time via external_components:, run arbitrary shell commands through compile and validation subprocesses, and read or write arbitrary files in the config and data directories. The practical impact is full compromise of the add-on, including the Home Assistant configuration directory it mounts and all ESPHome devices it manages. The exposure was present by default on every host-network HA add-on installation with no operator misconfiguration required; the standalone Docker dashboard and the password-gated public port (6052) are not affected (GitHub Advisory, ESPHome Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-59177. The vulnerability requires adjacent network access (attacker must be on the same LAN segment as the Home Assistant host), but no credentials, no user interaction, and no special configuration are needed — a single unauthenticated HTTP request to http://<ha-ip>:<ingress_port>/ suffices. The CVE status is currently "Reserved" and no EPSS score or CISA KEV catalog entry has been identified (GitHub Advisory, Feedly).

1. Reconnaissance: Identify the IP address of the Home Assistant host on the local network (e.g., via mDNS/Bonjour as homeassistant.local, ARP scan, or network discovery tools like nmap).
2. Identify the ingress port: Determine the ESPHome add-on's ingress port. The default is 8099, but it may vary; it can be inferred from the HA supervisor's add-on configuration or by scanning common ports on the HA host.
3. Access the unauthenticated dashboard: From any device on the same LAN, send an HTTP GET request directly to http://<ha-ip>:<ingress_port>/ (e.g., curl http://192.168.1.100:8099/). On vulnerable versions (< 1.0.10), the full ESPHome dashboard is returned with no authentication challenge.
4. Achieve code execution: Use the dashboard's compile functionality to submit a malicious ESPHome YAML configuration using external_components: to execute arbitrary Python, or leverage the compile/validation subprocesses to run arbitrary shell commands on the host.
5. Lateral movement / data exfiltration: Read or write arbitrary files in the mounted Home Assistant config directory, exfiltrate secrets (e.g., secrets.yaml), modify device firmware, or pivot to other systems managed by Home Assistant (GitHub Advisory, ESPHome Advisory).

• Network: Unexpected HTTP requests to the ESPHome ingress port (default 8099) originating from LAN IP addresses other than 127.0.0.1 or 172.30.32.2; unusual outbound connections from the Home Assistant host to external IPs following dashboard access.
• Logs: ESPHome device-builder access logs showing HTTP GET/POST requests to the ingress endpoint from non-supervisor source IPs; absence of authentication headers on ingress requests from LAN clients; ingress_peer_guard debug log entries (post-patch) indicating rejected non-trusted sources.
• File System: Unexpected modifications to files in the Home Assistant config directory (/config/) or ESPHome data directories; new or modified ESPHome YAML configuration files with unusual external_components: entries or shell commands.
• Process: Unusual child processes spawned by the ESPHome add-on process (e.g., bash, sh, python, curl, wget) not associated with normal device compilation; unexpected network connections initiated by ESPHome subprocesses (GitHub Advisory).

The primary remediation is to upgrade esphome-device-builder to version 1.0.10 or newer (delivered via the esphome container bundling device-builder 1.0.10+), which restricts the ingress site bind to 127.0.0.1 and 172.30.32.1 and adds the ingress_peer_guard middleware. For installations that cannot immediately upgrade, apply a host or router firewall rule to block external access to the ingress port (default 8099), allowing only the Home Assistant host and supervisor (172.30.32.2) to reach it. Additionally, ensure the Home Assistant host is on a trusted, isolated LAN segment and not accessible from guest or IoT network segments. Accessing the dashboard through Home Assistant's normal ingress URL remains unaffected and authenticated (ESPHome Advisory, Fix PR).

The fix was authored and merged by bdraco (a core ESPHome contributor) on June 18, 2026, with the security advisory published by the same author on June 20, 2026. The automated code review (esphbot/Copilot) praised the defense-in-depth approach of combining a restricted bind address with a TCP peer guard, noting it mirrors the legacy nginx ACL exactly. No significant broader media coverage or notable external researcher commentary has been identified beyond the GitHub advisory and pull request discussion (Fix PR, ESPHome Advisory).