Octoprint
CVE-2026-23892
MEDIUM
GHSA-xg4x-w2j3-57h6
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up to and including 1.11.5 are affected by a (theoretical) timing attack vulnerability that allows API key extraction over the network. Due to using character based comparison that short-circuits on the first mismatched character during API key validation, rather than a cryptographical method with static runtime regardless of the point of mismatch, an attacker with network based access to an affected OctoPrint could extract API keys valid on the instance by measuring the response times of the denied access responses and guess an API key character by character. The vulnerability is patched in version 1.11.6. The likelihood of this attack actually working is highly dependent on the network's latency, noise and similar parameters. An actual proof of concept was not achieved so far. Still, as always administrators are advised to not expose their OctoPrint instance on hostile networks, especially not on the public Internet.
AnalysisAI
OctoPrint versions up to 1.11.5 contain a timing attack vulnerability in API key validation that enables remote extraction of valid API keys through network-based response time analysis. An unauthenticated attacker with network access can exploit the character-by-character comparison method to gradually recover API keys by measuring authentication response delays. The attack's practicality depends heavily on network conditions, but a patch is available in version 1.11.6.
Technical ContextAI
Affects Octoprint. OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up to and including 1.11.5 are affected by a (theoretical) timing attack vulnerability that allows API key extraction over the network. Due to using character based comparison that short-circuits on the first mismatched character during API key validation, rather than a cryptographical method with static runtime regardless of the point of mismatch, an attacker with network based access to an affected Octo
RemediationAI
A vendor patch is available — apply it immediately. Fixed in version 1.11.6.. Restrict network access to the affected service where possible.
OctoPrint provides a web interface for controlling consumer 3D printers. Rated critical severity (CVSS 9.4), this vulner
OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or cause a denial of service via HTTP re
Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3. Rated high severity (CVSS 8.8), t
Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3. Rated high severity (CVSS 7.8), this
An attacker can freely brute force username and password and can takeover any account. Rated high severity (CVSS 7.5), t
Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0. Rated high severity (CVSS 7.5)
The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that ar
Cross-site Scripting (XSS) - Generic in GitHub repository octoprint/octoprint prior to 1.8.0. Rated medium severity (CVS
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters. Rated medium severi
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/o
Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3. Rated medium se
OctoPrint provides a web interface for controlling consumer 3D printers. Rated medium severity (CVSS 4.8), this vulnerab
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today