{"vulnerability": "GHSA-rrxg-g2pf-6hh4", "sightings": [{"uuid": "f543a361-55fc-4dd0-93f4-ace624c789f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-rrxg-g2pf-6hh4", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117270781388053699", "content": "WTF?\nhttps://github.com/esphome/device-builder/security/advisories/GHSA-rrxg-g2pf-6hh4\n\nThe dashboard reads its authentication credentials from $ESPHOME_USERNAME and $ESPHOME_PASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who had protected their dashboard with USERNAME / PASSWORD (as the older getting started guide documented) loses authentication on upgrade and the dashboard starts open to anyone who can reach its port.", "creation_timestamp": "2026-09-14T18:21:58.184872Z"}, {"uuid": "39862a7d-6338-46e8-bfdc-1ab8668dec2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-rrxg-g2pf-6hh4", "type": "seen", "source": "https://gist.github.com/alon710/3693f8803a657bff4ffb362747901533", "content": "# CVE-2026-59178: CVE-2026-59178: Authentication Bypass in ESPHome Device Builder Dashboard\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-09-14\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59178\n\n## Summary\nAn authentication bypass vulnerability in ESPHome Device Builder Dashboard allows unauthenticated remote attackers to gain administrative access. The flaw is caused by a backward compatibility break during an environment variable rename that silently disables dashboard authentication upon upgrade.\n\n## TL;DR\nESPHome Device Builder Dashboard silently disables authentication upon upgrading if operators rely on legacy USERNAME and PASSWORD environment variables, granting full unauthenticated administrative access to remote network attackers.\n\n## Technical Details\n\n- **CWE ID**: CWE-306 (Missing Authentication for Critical Function)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.8\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n- **Impact**: Unauthenticated Remote Code Execution and Firmware Manipulation\n\n## Affected Systems\n\n- ESPHome Device Builder Dashboard standalone container installations\n- **esphome-device-builder**: < 1.0.12 (Fixed in: `1.0.12`)\n- **ghcr.io/esphome/esphome**: < 2026.6.2 (Fixed in: `2026.6.2`)\n\n## Mitigation\n\n- Upgrade to esphome-device-builder >= 1.0.12\n- Rename environment variables to ESPHOME_USERNAME and ESPHOME_PASSWORD\n- Implement firewall or VPN access controls\n\n**Remediation Steps:**\n1. Identify any running instances of the ESPHome Device Builder Dashboard using docker ps.\n2. Inspect the container environment variables to verify if legacy USERNAME or PASSWORD is in use.\n3. Stop the container and update the configuration to use ESPHOME_USERNAME and ESPHOME_PASSWORD.\n4. Pull the latest image tag (2026.6.2 or higher) and restart the service.\n\n## References\n\n- [Official Security Advisory](https://github.com/esphome/device-builder/security/advisories/GHSA-rrxg-g2pf-6hh4)\n- [Fix Pull Request (PR #1625)](https://github.com/esphome/device-builder/pull/1625)\n- [Official Fix Commit](https://github.com/esphome/device-builder/commit/9e294f729c3eb7334bb57b9fc49b75b728052f52)\n- [Release Page (Version 1.0.12)](https://github.com/esphome/device-builder/releases/tag/1.0.12)\n- [ESPHome Security Best Practices Documentation](https://esphome.io/guides/security_best_practices/)\n- [ESPHome 2026.6.0 Changelog](https://esphome.io/changelog/2026.6.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59178) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-14T19:32:08.594827Z"}]}