CVE-2026-71260: ESPHome web_server Plaintext Password Disclosure via JSON "value" Field
ESPHome through 2026.7.0-dev discloses plaintext passwords via its webserver component. In WebServer::textjson() (esphome/components/webserver/webserver.cpp), a text entity configured with mode: password (TEXTMODEPASSWORD) has its JSON "state" field correctly masked as "", but the same serialization path unconditionally writes the raw password into the JSON "value" field via setjsoniconstatevalue()/setjsonvalue(). Because webserver listens on port 80 with no authentication by default, any attacker on the local network can retrieve the plaintext password (e.g. WiFi credentials, API tokens) via GET /text/<entityid> or the /events EventSource stream.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ESPHome web_serverto a version that resolves this vulnerability.Fixed in 2026.7.0-dev - Compensating control
Restrict network access to the ESPHome web server (port 80) to trusted hosts only (e.g., via firewall/ACL) because it listens on port 80 with no authentication by default, allowing local-network attackers to retrieve plaintext passwords.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71260?
CVE-2026-71260 has a medium severity score of 6.5.
What is the risk associated with CVE-2026-71260?
The risk associated with CVE-2026-71260 is rated as 38.
How do I fix CVE-2026-71260?
To mitigate CVE-2026-71260, update ESPHome to a version that addresses the plaintext password disclosure issue.
What type of information is disclosed in CVE-2026-71260?
CVE-2026-71260 discloses plaintext passwords via the JSON 'value' field in the web_server component.
Which component is affected by CVE-2026-71260?
The web_server component of ESPHome is affected by CVE-2026-71260.