PYSEC-2026-3834: ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces
ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the Home Assistant add-on's trusted ingress site binds to 0.0.0.0 while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the Home Assistant host's LAN interface. Any device on that local network can therefore connect directly to the ingress port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through externalcomponents:, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted Home Assistant configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ESPHome Device Builder Dashboardto a version that resolves this vulnerability.Fixed in 1.0.10
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only the Home Assistant add-on deployment of ESPHome Device Builder before 1.0.10 is affected, because its trusted ingress site is exposed on the Home Assistant host's LAN interface. Standalone Docker deployments and the password-protected public port 6052 are not affected.
What does an attacker need to exploit the issue?
An attacker only needs network access to the local LAN interface where the Home Assistant host is reachable. No dashboard credentials, operator misconfiguration, or user interaction is required.
What could an attacker do after reaching the exposed dashboard?
The attacker can obtain full dashboard access, including compile-time Python execution through external_components and shell execution through compile and validation subprocesses. This can provide arbitrary access to mounted Home Assistant configuration and data files and compromise managed ESPHome devices.
What is the remediation?
Upgrade ESPHome Device Builder to version 1.0.10, which fixes the issue.