CVE-2026-71260
Received Received - Intake

ESPHome Web Server Plaintext Password Disclosure

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_() (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON "state" field correctly masked as "********", but the same serialization path unconditionally writes the raw password into the JSON "value" field via set_json_icon_state_value()/set_json_value(). Because web_server listens on port 80 with no authentication by default, any attacker on the local network can retrieve the plaintext password (e.g. WiFi credentials, API tokens) via GET /text/<entity_id> or the /events EventSource stream.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71260
EUVD
EUVD-2026-53345

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
esphome esphome to 2026.7.0-dev (inc)
esphome esphome 2026.7.0-dev

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ESPHome versions up to 2026.7.0-dev have a flaw in the web_server component where plaintext passwords are exposed. When a password field is configured, the JSON state field is masked as asterisks but the raw password is written to the JSON value field. Attackers on the local network can retrieve these passwords via specific API endpoints like GET /text/<entity_id> or the /events stream.

Detection Guidance

Check if ESPHome is running on port 80 without authentication. Use commands like 'curl http://<device_ip>/text/<entity_id>' to see if plaintext passwords are exposed in JSON responses. Monitor network traffic for unencrypted requests to port 80.

Impact Analysis

This vulnerability allows attackers on the same local network to steal plaintext passwords, including WiFi credentials and API tokens. These credentials could be used to gain unauthorized access to the network, intercept communications, or compromise connected devices managed by ESPHome.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Exposure of credentials may result in data breaches, triggering compliance violations, legal penalties, and reputational damage for affected organizations.

Mitigation Strategies

Disable the ESPHome web server if not needed. Enable authentication if the server must run. Update ESPHome to the latest version. Restrict network access to the device via firewall rules to prevent local network attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71260. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart