CVE-2026-59178 Microsoft Sentinel · KQL

Detect ESPHome Device Builder Dashboard Authentication Bypass (CVE-2026-59178) in Microsoft Sentinel

Detects exploitation and exposure of CVE-2026-59178, a missing-authentication vulnerability (CWE-306) in ESPHome Device Builder versions prior to 1.0.12. An upgrade renamed the dashboard authentication environment variables; deployments still setting the old variable names silently start with authentication disabled, exposing the ESPHome dashboard (default port 6052) to unauthenticated access. Unauthenticated actors can then reach device configuration, OTA firmware compilation/flashing, and secrets management. This detection surfaces unauthenticated dashboard access, sensitive dashboard/API endpoint hits without prior authentication, and OTA/compile actions originating from unauthenticated sessions.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let dashboardPort = dynamic([6052]);
let sensitivePaths = dynamic(["/login", "/devices", "/edit", "/compile", "/upload", "/ota", "/secret_keys", "/download.bin", "/api/"]);
CommonSecurityLog
| where DestinationPort in (dashboardPort) or RequestURL has_any (sensitivePaths)
| where RequestMethod in ("GET","POST")
| extend HasAuth = tostring(AdditionalExtensions) has "Authorization" or tostring(AdditionalExtensions) has "Cookie="
| where HasAuth == false
| where RequestURL has_any (sensitivePaths)
| summarize Hits=count(), Paths=make_set(RequestURL, 25), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort
| where Hits >= 1
| order by Hits desc
critical severity medium confidence

Flags unauthenticated HTTP requests to ESPHome Device Builder dashboard endpoints (default port 6052) reaching sensitive device, compile and OTA paths, consistent with the auth-disabled state of CVE-2026-59178.

Data Sources

Network Proxy LogsWeb Application FirewallReverse Proxy / Ingress Access Logs

Required Tables

CommonSecurityLog

False Positives & Tuning

  • Internal health-check or uptime monitors polling the dashboard without credentials on an intentionally trusted network.
  • Authorized administrators legitimately accessing the dashboard from a bastion where auth is terminated upstream by a reverse proxy.
  • Vulnerability scanners run by the security team probing dashboard endpoints during authorized assessments.

Other platforms for CVE-2026-59178

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Start ESPHome Device Builder with renamed/unset auth variables (auth disabled)

    Expected signal: Container start event and a service listening on TCP 6052 with no authentication challenge on HTTP requests.

  2. Test 2Unauthenticated access to device list endpoint

    Expected signal: Web/proxy access log entry: GET /devices on port 6052 with no Authorization or Cookie header, HTTP 200.

  3. Test 3Unauthenticated OTA/compile endpoint probe

    Expected signal: Web/proxy access log entry: POST /compile on port 6052 without auth headers.

Last updated: 2026-09-18 Research depth: standard
References (5)

Response Playbook

Triage

  1. Confirm the ESPHome Device Builder version on the affected host: run `pip show esphome-device-builder` (or inspect the container image tag) and flag any version < 1.0.12.
  2. Inspect the running process/container environment for the deprecated authentication variables and confirm whether the renamed variables are set; an unset/renamed auth variable means the dashboard started with authentication disabled.
  3. Review reverse-proxy and dashboard access logs for the source IPs identified by the detection and determine whether any unauthenticated session reached /devices, /edit, /compile, /ota, or /secret_keys.
  4. Determine the network exposure of port 6052 (internet-facing, VLAN, or localhost-only) to establish blast radius.

Containment

  1. Immediately restrict network access to port 6052 via firewall/security group so only trusted management hosts can reach the dashboard, or take the dashboard offline until patched.
  2. Restore authentication by setting the correct (renamed) auth environment variables, or place the dashboard behind an authenticating reverse proxy, then restart the service and verify a login prompt is enforced.
  3. Upgrade ESPHome Device Builder to 1.0.12 or later on all affected instances.

Evidence Collection

  1. Preserve dashboard and reverse-proxy access logs covering the exposure window, including request methods, URLs and source IPs, before any log rotation.
  2. Capture the current process environment and container configuration (`/proc/<pid>/environ`, compose/helm manifests) to document which auth variables were set.
  3. Export the list of device configurations, secrets files, and any firmware binaries that were accessed or downloaded during the unauthenticated window.

Escalation Criteria

  • !Escalate to incident response if logs show an unauthenticated session performed an OTA/compile/upload action or downloaded firmware or secret_keys.
  • !Escalate if the dashboard on port 6052 was reachable from the public internet during the exposure window.
  • !Escalate if device configurations or ESPHome secrets appear to have been modified or exfiltrated by an unauthenticated source.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >Reverse-proxy/dashboard access logs showing unauthenticated requests to /devices, /compile and /ota endpoints.
  • >Process environment (`/proc/<pid>/environ`) or container manifest showing the deprecated auth variable names.
  • >ESPHome build/OTA artifacts (compiled .bin firmware) and modified device YAML configs under the ESPHome config directory.

Tuning Guidance

Baseline known monitoring and load-balancer source IPs that legitimately poll the dashboard without credentials and exclude them. If a reverse proxy terminates authentication upstream, the captured logs will lack Authorization headers on every request — in that case anchor the rule on external/untrusted source IPs and on the sensitive path list (/compile, /ota, /secret_keys) rather than on the absence of the header alone. Prioritize alerts where port 6052 is reachable from outside the management network.

Hunting Queries

Hunts for unauthenticated OTA/compile/firmware-download activity against the ESPHome dashboard indicating post-exposure abuse.

Hunting — KQL
kql 
CommonSecurityLog | where DestinationPort == 6052 | where RequestURL has_any ("/compile","/ota","/upload","/download.bin") | where tostring(AdditionalExtensions) !has "Authorization" | summarize count() by SourceIP, RequestURL, bin(TimeGenerated, 1h)
Hunting — SPL
spl 
index=web dest_port=6052 (uri_path="/compile" OR uri_path="/ota" OR uri_path="/upload" OR uri_path="/download.bin") NOT _raw="*Authorization:*" | stats count by src_ip, uri_path

Atomic Red Team Tests

Test 1 Start ESPHome Device Builder with renamed/unset auth variables (auth disabled)
linux

Launches a vulnerable device-builder instance in a lab using the deprecated auth environment variable names, reproducing the silently-disabled authentication state.

Command

bash 
docker run -d --name esphome-cve-test -p 6052:6052 -e ESPHOME_DASHBOARD_USE_PING=false -e OLD_DASHBOARD_USERNAME=admin -e OLD_DASHBOARD_PASSWORD=admin ghcr.io/esphome/esphome:1.0.11

Cleanup

bash 
docker rm -f esphome-cve-test

Expected Telemetry

Container start event and a service listening on TCP 6052 with no authentication challenge on HTTP requests.

Expected Detection

Not directly alerted; establishes the vulnerable listener for subsequent unauthenticated-access tests.

Test 2 Unauthenticated access to device list endpoint
linux

Sends an unauthenticated HTTP request to the dashboard /devices endpoint and confirms a 200 response instead of a login redirect.

Command

bash 
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:6052/devices

Cleanup

bash 
true

Expected Telemetry

Web/proxy access log entry: GET /devices on port 6052 with no Authorization or Cookie header, HTTP 200.

Expected Detection

KQL/SPL/EQL rules fire on unauthenticated GET /devices to port 6052.

Test 3 Unauthenticated OTA/compile endpoint probe
linux

Issues an unauthenticated request to the compile/OTA path to simulate an attacker preparing to build or flash firmware without credentials.

Command

bash 
curl -s -X POST http://127.0.0.1:6052/compile -H 'Content-Type: application/json' -d '{"configuration":"test.yaml"}' -o /dev/null -w '%{http_code}\n'

Cleanup

bash 
true

Expected Telemetry

Web/proxy access log entry: POST /compile on port 6052 without auth headers.

Expected Detection

Hunting query and primary detections flag unauthenticated POST to /compile, indicating potential OTA abuse.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege Escalation

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid Accounts

Same Tactic: Initial Access

Popular Detections