Esphome vulnerabilities

Products

• Esphome 8
• Device-builder 2
• Firmware 2

Newest

• esphome device-builder ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade CVE-2026-59178 Fix available 9.8 CriticalSeptember 14, 2026
• esphome device-builder ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces CVE-2026-59177 Fix available 8.8 HighSeptember 9, 2026
• esphome ESPHome web_server Plaintext Password Disclosure via JSON "value" Field CVE-2026-71260 6.5 MediumAugust 5, 2026
• esphome ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution CVE-2026-71259 8.6 HighAugust 5, 2026
• esphome ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component CVE-2026-23833 Fix available 1.7 LowJanuary 19, 2026
• esphome, esphome firmware +1 more ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header CVE-2025-57808 Fix available 8.1 HighSeptember 2, 2025
• esphome ESPHome vulnerable to Authentication bypass via Cross site request forgery CVE-2024-29019 Fix available 8.1 HighMarch 21, 2024
• esphome ESPHome vulnerable to stored Cross-site Scripting in edit configuration file API CVE-2024-27287 Fix available 6.5 MediumMarch 6, 2024
• esphome ESPHome remote code execution via arbitrary file write CVE-2024-27081 Fix available 7.2 HighFebruary 26, 2024
• esphome, esphome firmware +1 more web_server allows OTA update without checking user defined basic auth username & password CVE-2021-41104 Fix available 7.5 HighSeptember 28, 2021