What’s Vulnerable › Products

esphome device-builder vulnerabilities

2 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 2 published in the last 12 months.

Check whether your esphome device-builder version is affected

Latest esphome device-builder vulnerabilities

• CVE-2026-59177 — ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces (CVSS 8.8)
• CVE-2026-59178 — ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade (CVSS 9.8)