Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-2363

NIXPKGS-2026-2363
published 10 hours ago
ESPHome web_server Plaintext Password Disclosure via JSON "value" Field
Permalink CVE-2026-71260
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Adjacent (A)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Adjacent (A)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 10 hours ago by @LeSuisse Activity log
  • Created suggestion 14 hours ago
  • @LeSuisse ignored
    8 packages
    • python313Packages.aioesphomeapi
    • python313Packages.bleak-esphome
    • python314Packages.aioesphomeapi
    • python314Packages.bleak-esphome
    • python313Packages.esphome-glyphsets
    • python314Packages.esphome-glyphsets
    • python313Packages.esphome-dashboard-api
    • python314Packages.esphome-dashboard-api
    10 hours ago
  • @LeSuisse ignored reference https://g… 10 hours ago
  • @LeSuisse accepted 10 hours ago
  • @LeSuisse published on GitHub 10 hours ago
ESPHome web_server Plaintext Password Disclosure via JSON "value" Field

ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_() (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON "state" field correctly masked as "********", but the same serialization path unconditionally writes the raw password into the JSON "value" field via set_json_icon_state_value()/set_json_value(). Because web_server listens on port 80 with no authentication by default, any attacker on the local network can retrieve the plaintext password (e.g. WiFi credentials, API tokens) via GET /text/<entity_id> or the /events EventSource stream.

Affected products

esphome
  • =<2026.7.0

Matching in nixpkgs

Ignored packages (8)

Package maintainers