CVE-2026-71260mediumCWE-522

CVE-2026-71260: medium-severity vulnerability in esphome

ESPHome web_server Plaintext Password Disclosure via JSON "value" Field

Published · Updated

Follow this CVE+ Monitor esphome

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.3%
ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON "state" field correctly masked as "********", but the same serialization path unconditionally writes the raw password into the JSON "value" field via set_json_icon_state_value/set_json_value.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
esphome · esphome
Related CVEs — esphome

In the same product, most dangerous first.

CVE-2025-57808HIGHESP-IDF web_server basic auth bypass using empty or incomplete Authorization headerEPSS 1.5%CVE-2024-27081HIGHESPHome remote code execution via arbitrary file writeEPSS 1.5%CVE-2021-41104HIGHweb_server allows OTA update without checking user defined basic auth username & passwordEPSS 1.2%CVE-2024-27287MEDIUMESPHome vulnerable to stored Cross-site Scripting in edit configuration file APIEPSS 0.7%CVE-2026-23833LOWESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API componentEPSS 0.3%CVE-2024-29019HIGHESPHome vulnerable to Authentication bypass via Cross site request forgeryEPSS 0.3%