ESPHome Device Builder Dashboard Authentication Bypass (CVE-2026-59178)

let dashboardPort = dynamic([6052]);
let sensitivePaths = dynamic(["/login", "/devices", "/edit", "/compile", "/upload", "/ota", "/secret_keys", "/download.bin", "/api/"]);
CommonSecurityLog
| where DestinationPort in (dashboardPort) or RequestURL has_any (sensitivePaths)
| where RequestMethod in ("GET","POST")
| extend HasAuth = tostring(AdditionalExtensions) has "Authorization" or tostring(AdditionalExtensions) has "Cookie="
| where HasAuth == false
| where RequestURL has_any (sensitivePaths)
| summarize Hits=count(), Paths=make_set(RequestURL, 25), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort
| where Hits >= 1
| order by Hits desc

index=web (dest_port=6052 OR uri_path IN ("/login","/devices","/edit","/compile","/upload","/ota","/secret_keys","/download.bin") OR uri_path="/api/*")
| eval has_auth=if(match(_raw,"(?i)authorization:") OR match(_raw,"(?i)cookie:"),1,0)
| where has_auth=0
| stats count as hits values(uri_path) as paths min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip dest_port
| where hits>=1
| sort - hits

network where destination.port == 6052 and http.request.method in ("GET", "POST") and
  (url.path : ("/devices", "/edit", "/compile", "/upload", "/ota", "/secret_keys", "/download.bin", "/api/*")) and
  not http.request.headers.authorization : "*"

SELECT sourceip, destinationip, destinationport, "URL", "Request Method", COUNT(*) AS hits FROM events WHERE (destinationport = 6052 OR "URL" ILIKE '%/compile%' OR "URL" ILIKE '%/ota%' OR "URL" ILIKE '%/secret_keys%' OR "URL" ILIKE '%/devices%' OR "URL" ILIKE '%/download.bin%') AND ("Request Header" NOT ILIKE '%authorization%' AND "Request Header" NOT ILIKE '%cookie%') GROUP BY sourceip, destinationip, destinationport, "URL", "Request Method" LAST 24 HOURS

_sourceCategory=*proxy* OR _sourceCategory=*web*
| where (dest_port = "6052" OR url matches "*/compile*" OR url matches "*/ota*" OR url matches "*/secret_keys*" OR url matches "*/devices*" OR url matches "*/download.bin*")
| if (_raw matches "*Authorization:*" OR _raw matches "*Cookie:*", 1, 0) as has_auth
| where has_auth = 0
| count as hits, min(_messagetime) as first_seen, max(_messagetime) as last_seen by src_ip, dest_ip, url
| where hits >= 1
| sort by hits desc

rule esphome_device_builder_auth_bypass_cve_2026_59178 {
  meta:
    author = "Argus"
    description = "Unauthenticated access to ESPHome Device Builder dashboard/OTA endpoints (CVE-2026-59178)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (
      $e.principal.port = 6052 or
      $e.target.url = /\/(compile|ota|secret_keys|devices|download\.bin|edit|upload)/ nocase
    )
    $e.network.http.method = /GET|POST/
    not $e.network.http.request_header = /(?i)authorization/
    $e.principal.ip = $ip
  match:
    $ip over 10m
  condition:
    $e
}

#event_simpleName=/HttpRequest|NetworkConnect/
| RemotePort=6052 OR HttpPath=/\/(compile|ota|secret_keys|devices|download\.bin)/i
| HttpMethod=/GET|POST/i
| NOT HttpRequestHeader=/(?i)authorization/
| groupBy([aid, RemoteAddressIP4, HttpPath], function=count(as=hits))
| hits >= 1
| sort(hits, order=desc)