CVE-2026-53459
CVE-2026-53459 is a critical-severity vulnerability with a CVSS 4.0 base score of 9.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-636.
Key facts
- Severity: Critical (CVSS 4.0 base score 9.3)
- EPSS exploit prediction: 0% (36th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-636
- Published:
- Last modified:
Description
Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database access to fail, granting unauthenticated access to all protected endpoints. Version 0.2.4.4 patches the issue.
Frequently asked questions
- What is CVE-2026-53459?
- Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database access to fail, granting unauthenticated access to all protected endpoints. Version 0.2.4.4 patches the issue.
- How severe is CVE-2026-53459?
- CVE-2026-53459 has a CVSS 4.0 base score of 9.3, rated critical severity.
- Is CVE-2026-53459 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (36th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-53459?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2026-53459 published?
- CVE-2026-53459 was published on 2026-09-15 and last updated on 2026-09-17.
References
- https://github.com/maziggy/bambuddy/blob/449502cc9fc1cec04f06d31512420eac729fd032/backend/app/core/auth.py#L473-L483
- https://github.com/maziggy/bambuddy/blob/449502cc9fc1cec04f06d31512420eac729fd032/backend/app/main.py#L5314-L5316
- https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.md
- https://github.com/maziggy/bambuddy/commit/845ad39b19bf99afeea571c6bae09695777e1460
- https://github.com/maziggy/bambuddy/releases/tag/v0.2.4.4
- https://github.com/maziggy/bambuddy/security/advisories/GHSA-6mf4-q26m-47pv
Other CWE-636 vulnerabilities
- CVE-2026-22034 — Critical (CVSS 9.8): Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a…
- CVE-2024-3729 — Critical (CVSS 9.8): The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling…
- CVE-2026-40525 — Critical (CVSS 9.1): OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route…
- CVE-2026-77866 — Critical (CVSS 9.0): Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls a validated URL to…
- CVE-2026-68746 — High (CVSS 8.8): Not Failing Securely ('Failing Open') vulnerability in livebook-dev livebook allows an unauthenticated network client…
- CVE-2024-43532 — High (CVSS 8.8): Remote Registry Service Elevation of Privilege Vulnerability