Skip to content
OpenAdvisories

Vendor

esphome

10 known vulnerabilities.

esphome at a glance

Last 12 months
5
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 1 vulnerability February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 2 vulnerabilities September 2026: 1 vulnerability, 1 critical Sep October 2026: 1 vulnerability November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202610
Sep 202611
Aug 202620
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202610
Dec 202500
Nov 202500
Oct 202500
Sep 202510
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

esphome 8 device-builder 2
All Critical High Medium Low Exploited only Public exploit

10 results · Feed

  • High 8.8
    CVE-2026-59177

    ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

    ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is …

    esphome device-builder esphome-device-builder PyPI
  • Critical 9.8
    CVE-2026-59178

    ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

    ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from `$ESPHOME_USERNAME` and `$ESPHOME_PASSWORD`. Earlier versions, and the legacy `esphome` …

    esphome device-builder esphome-device-builder PyPI
  • Medium 6.5
    CVE-2026-71260

    ESPHome web_server Plaintext Password Disclosure via JSON "value" Field

    ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON "state" field corr…

    esphome esphome
  • High 8.6
    CVE-2026-71259

    ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

    ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the external_compone…

    esphome esphome
  • Low 1.7
    CVE-2026-23833

    ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component

    ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. The…

    esphome esphome esphome PyPI
  • High 8.1
    CVE-2025-57808

    ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header

    ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value i…

    esphome esphome esphome PyPI
  • High 8.1
    CVE-2024-29019

    ESPHome vulnerable to Authentication bypass via Cross site request forgery

    ESPHome is a system to control microcontrollers remotely through Home Automation systems. API endpoints in dashboard component of ESPHome version 2023.12.9 (command line installation) are vulnerable to Cross-Site Request Forgery (CSRF) allowing remote attacke…

    esphome esphome esphome PyPI
  • Medium 6.5
    CVE-2024-27287

    ESPHome vulnerable to stored Cross-site Scripting in edit configuration file API

    ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems. Starting in version 2023.12.9 and prior to version 2024.2.2, editing the configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation and H…

    esphome esphome esphome PyPI
  • High 7.2
    CVE-2024-27081

    ESPHome remote code execution via arbitrary file write

    ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbit…

    esphome esphome esphome PyPI
  • High 7.5
    CVE-2021-41104

    web_server allows OTA update without checking user defined basic auth username & password

    ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic …

    esphome esphome esphome PyPI