CVE-2026-23892
CVE-2026-23892 is a medium-severity vulnerability in Octoprint with a CVSS 3.x base score of 5.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-208.
Key facts
- Severity: Medium (CVSS 3.x base score 5.9)
- CVSS v4: 6.0
- EPSS exploit prediction: 0% (38th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-4775
- Weakness: CWE-208
- Affected product: Octoprint
- Published:
- Last modified:
Description
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up to and including 1.11.5 are affected by a (theoretical) timing attack vulnerability that allows API key extraction over the network. Due to using character based comparison that short-circuits on the first mismatched character during API key validation, rather than a cryptographical method with static runtime regardless of the point of mismatch, an attacker with network based access to an affected OctoPrint could extract API keys valid on the instance by measuring the response times of the denied access responses and guess an API key character by character. The vulnerability is patched in version 1.11.6. The likelihood of this attack actually working is highly dependent on the network's latency, noise and similar parameters. An actual proof of concept was not achieved so far. Still, as always administrators are advised to not expose their OctoPrint instance on hostile networks, especially not on the public Internet.
Frequently asked questions
- What is CVE-2026-23892?
- OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up to and including 1.11.5 are affected by a (theoretical) timing attack vulnerability that allows API key extraction over the network. Due to using character based comparison that short-circuits on the first mismatched character during API key validation, rather than a cryptographical method with static runtime regardless of the point of mismatch, an attacker with network based access to an affected OctoPrint could extract API keys valid on the instance by measuring the response times of the denied access responses and guess an API key character by character. The vulnerability is patched in version 1.11.6. The likelihood of this attack actually working is highly dependent on the network's latency, noise and similar parameters. An actual proof of concept was not achieved so far. Still, as always administrators are advised to not expose their OctoPrint instance on hostile networks, especially not on the public Internet.
- How severe is CVE-2026-23892?
- CVE-2026-23892 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2026-23892 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (38th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-23892?
- CVE-2026-23892 affects Octoprint. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-23892?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-23892 have an EU (EUVD) identifier?
- Yes. CVE-2026-23892 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-4775.
- When was CVE-2026-23892 published?
- CVE-2026-23892 was published on 2026-01-27 and last updated on 2026-06-17.
References
- https://github.com/OctoPrint/OctoPrint/commit/249fd80ab01bc4b7dabedff768230a0fb5d01a8c
- https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.6
- https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-xg4x-w2j3-57h6
Affected products (1)
- cpe:2.3:a:octoprint:octoprint:*:*:*:*:*:*:*:*
More vulnerabilities in Octoprint
- CVE-2018-16710 — Critical (CVSS 9.1): OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or cause a denial of service via HTTP…
- CVE-2025-58180 — High (CVSS 8.8): OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including…
- CVE-2022-3068 — High (CVSS 8.8): Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3.
- CVE-2022-2930 — High (CVSS 7.8): Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.
- CVE-2022-2822 — High (CVSS 7.5): An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess…
- CVE-2022-1430 — High (CVSS 7.5): Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0.
All CVEs affecting Octoprint →
Other CWE-208 vulnerabilities
- CVE-2023-41313 — Critical (CVSS 9.8): The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks. Users are recommended…
- CVE-2024-42512 — High (CVSS 8.6): Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass…
- CVE-2025-53940 — High (CVSS 8.5): Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central…
- CVE-2026-47784 — High (CVSS 8.1): In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because…
- CVE-2026-47783 — High (CVSS 8.1): In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a…
- CVE-2026-42602 — High (CVSS 8.1): azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass…