ESPHome through version 2026.7.0-dev contains a vulnerability (CVE-2026-71260) in its web_server component where plaintext passwords are exposed via JSON responses. Specifically, in the WebServer::text_json_() function, password fields are masked in the "state" field but the raw password is still included in the "value" field. Since the web_server listens on port 80 without authentication by default, any attacker on the local network can access these plaintext passwords by sending GET requests to /text/<entity_id> or by connecting to the /events EventSource stream. This vulnerability corresponds to CWE-522 (Insufficiently Protected Credentials).

An attacker on the local network can obtain plaintext passwords such as WiFi credentials and API tokens from the vulnerable ESPHome device without authentication. This exposure can lead to unauthorized access to network resources or control of the device. The CVSS 3.1 base score is 6.5 (medium severity), reflecting that the attack requires local network access but results in high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local network access to the ESPHome device's web_server port 80 to trusted users only. Consider disabling or restricting the web_server component if possible to prevent unauthorized access to sensitive information.