CVE-2026-71260

MediumCVSS 6.5

Published: 05/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON "state" field correctly masked as "********", but the same serialization path unconditionally writes the raw password into the JSON "value" field via set_json_icon_state_value/set_json_value.

Risk Assessment

Disclosure of plaintext passwords could allow an attacker to intercept credentials and gain unauthorized access to devices.

Recommendation

It is recommended to update ESPHome to a version after 2026.7.0-dev and ensure that password fields are not exposed in JSON responses.

Other vulnerabilities in ESPHome

CVE-2026-71259High
ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because [operator] binds tighter than [operator], any file: URI passes validation regardless of netloc. This validator gates the field of the external_components YAML directive's git source schema, which is passed to [function] (git supports file:// natively).

Original NVD description (English source)