CVE-2026-71260: ESPHome Information Disclosure Vulnerability

CVE-2026-71260 Overview

CVE-2026-71260 is an information disclosure vulnerability in ESPHome through version 2026.7.0-dev. The web_server component leaks plaintext passwords through its JSON serialization path. Text entities configured with mode: password (TEXT_MODE_PASSWORD) correctly mask the state field as ********, but the same code writes the raw secret to the JSON value field. Because web_server listens on TCP port 80 without authentication by default, any attacker on the adjacent network can retrieve credentials such as WiFi passwords and API tokens by issuing a GET request to /text/<entity_id> or subscribing to the /events EventSource stream.

Critical Impact
Attackers on the local network can extract plaintext passwords, WiFi credentials, and API tokens from ESPHome devices without authentication.

Affected Products

ESPHome versions through 2026.7.0-dev
ESPHome web_server component (esphome/components/web_server/web_server.cpp)
ESP-based IoT devices running vulnerable ESPHome firmware with the web server enabled

Discovery Timeline

2026-08-05 - CVE-2026-71260 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71260

Vulnerability Analysis

The flaw resides in the WebServer::text_json_() function within esphome/components/web_server/web_server.cpp. When a text entity is declared with mode: password, the serialization logic recognizes the TEXT_MODE_PASSWORD flag and substitutes the JSON state field with an asterisk-masked string. The same code path then calls set_json_icon_state_value() and set_json_value(), which unconditionally serialize the underlying raw string into the JSON value field. The masking logic never propagates to value, so both masked and unmasked representations of the secret ship in the same response body.

This maps to CWE-522: Insufficient Credentially Protected Credentials. The web_server component binds to port 80 without requiring authentication in its default configuration. Any host with layer-2 or routed access to the device can therefore query the endpoint and receive the sensitive payload. The confidentiality impact is high; integrity and availability are unaffected.

Root Cause

The root cause is a divergence between the masking logic applied to the state field and the direct string copy used for the value field. Developers correctly implemented obfuscation for one output channel but left a parallel channel exposing the same secret. The absence of default authentication on the web_server compounds the design flaw by removing any access control layer that would otherwise limit exposure.

Attack Vector

An attacker with adjacent network access, for example a device on the same WiFi segment, issues an HTTP GET to http://<device-ip>/text/<entity_id> or opens the /events Server-Sent Events stream. The JSON response includes the value field containing the plaintext password. Because ESPHome text entities frequently store WiFi PSKs, cloud API tokens, and third-party service credentials, the extracted secrets often provide lateral movement into the broader home or industrial network.

Detailed technical context is available in the ESPHome web server source code and the ESPHome project repository.

Detection Methods for CVE-2026-71260

Indicators of Compromise

HTTP GET requests to /text/<entity_id> endpoints on ESPHome devices originating from unexpected hosts on the local network.
Unauthenticated connections to the /events EventSource stream on port 80 of IoT devices.
JSON responses from ESPHome devices containing populated value fields alongside masked state fields.

Detection Strategies

Inspect local network traffic for HTTP requests targeting ESPHome device ports and flag responses that include readable password material.
Correlate DHCP leases and mDNS advertisements for ESPHome hosts, then audit which endpoints on the LAN are permitted to reach them.
Deploy network segmentation monitoring to identify clients probing IoT subnets for /text/ or /events paths.

Monitoring Recommendations

Log all inbound connections to IoT device management ports and alert on requests from non-administrator hosts.
Periodically scan the network for ESPHome devices exposing port 80 without authentication using a controlled vulnerability scanner.
Track configuration drift on IoT devices to confirm that web_server remains disabled or restricted to trusted management VLANs.

How to Mitigate CVE-2026-71260

Immediate Actions Required

Disable the web_server component on ESPHome devices that do not require it by removing the web_server: block from device YAML and reflashing.
Rotate any passwords, WiFi PSKs, and API tokens that were stored in text entities on affected devices, since prior exposure cannot be ruled out.
Isolate ESPHome devices on a dedicated IoT VLAN with firewall rules that block access from user endpoints.

Patch Information

As of the NVD publication on 2026-08-05, the issue affects ESPHome through 2026.7.0-dev. Monitor the ESPHome project repository for a fixed release that masks the value field in WebServer::text_json_() in addition to the state field.

Workarounds

Configure web_server with authentication enabled by setting auth: credentials, and prefer HTTPS-terminating reverse proxies where feasible.
Avoid storing sensitive secrets in text entities exposed by the web server; use secrets.yaml values referenced only by internal components.
Restrict the web_server component with the include_internal: false option and remove password-mode text entities from web exposure.

bash

# Example ESPHome configuration hardening
web_server:
  port: 80
  auth:
    username: !secret web_user
    password: !secret web_password
  include_internal: false

# Preferred: disable the web server entirely if not required
# web_server: