CVE-2026-71260

MEDIUM 6.5

ESPHome web_server Plaintext Password Disclosure via JSON "value" Field

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON "state" field correctly masked as "********", but the same serialization path unconditionally writes the raw password into the JSON "value" field via set_json_icon_state_value/set_json_value.

CWE	CWE-522
Vendor	esphome
Product	esphome
Published	Aug 5, 2026
Last Updated	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for esphome esphome

Be the first to know when new medium vulnerabilities affecting esphome esphome are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

esphome / esphome

0 ≤ 2026.7.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/esphome/esphome github.com: https://github.com/esphome/esphome/blob/dev/esphome/components/web_server/web_server.cpp

Credits

Alibek Baxtiyorov