What is CVE-2026-71260?
CVE-2026-71260 is a vulnerability in ESPHome's web_server component where, for a text entity with mode: password, the JSON response masks the secret in the 'state' field but leaks the same plaintext password in a different field. This affects ESPHome versions up to 2026.7.0-dev. Users should upgrade to a patched version that removes the plaintext disclosure.
Azərbaycanca: CVE-2026-71260 ESPHome-un web_server komponentindəki zəiflikdir, burada mode: password olaraq təyin edilmiş text entity-nin JSON cavabının 'state' sahəsində şifrə maskalanır, lakin eyni cavabda şifrə açıq mətn şəklində başqa bir sahədə sızır. Bu, ESPHome-un 2026.7.0-dev versiyasına qədər olan istifadəçiləri təsir edir. İstifadəçilərə zəiflik aradan qaldırılan yenilənmiş versiyaya keçmələri tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-200
FAQ2
Which versions of ESPHome are affected by CVE-2026-71260?
The vulnerability affects ESPHome versions up to 2026.7.0-dev.
How does the password data leak in CVE-2026-71260?
For a text entity with mode: password in the web_server component, the JSON response masks the secret in the 'state' field but leaks the plaintext password in a different field within the same response.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.