Cups CVE-2026-34990

This vulnerability carries severe real-world risk despite the absence of CVSS and EPSS data. Multiple high-impact risk signals are present: (1) Attack vector is local (limited initial access scope, but network-accessible localhost service setup is feasible), (2) No privileges required (PR:N equivalent - unprivileged local users can exploit), (3) Technical impact is complete system compromise (arbitrary root-level file write and code execution via sudoers persistence), (4) A working proof-of-concept exists, demonstrating exploit reliability and attack complexity is low once the authentication token is captured. The authentication bypass (CWE-287) is fundamental - the vulnerability is not merely about improper authorization on a single endpoint, but about token generation and reuse logic that defeats the intended security model. SSVC analysis: exploitation is confirmed (POC exists and attack is demonstrated), the attack is not trivially automatable across all CUPS deployments but is highly reproducible on vulnerable systems, and technical impact is maximal (root code execution). Absence of vendor patches at publication time indicates this is a 0-day disclosure, elevating priority. This is NOT a low-impact issue inflated by CVSS scoring - the real-world attack surface and demonstrated exploit make this a critical priority for any Linux/Unix system running CUPS 2.4.16 or earlier.

An unprivileged local user on a Linux system running CUPS 2.4.16 sets up a listener on localhost that mimics an IPP service. When they trigger a CUPS operation (e.g., printer discovery), cupsd connects to this rogue service and transmits an Authorization: Local token. The attacker captures and replays this token to access CUPS' administrative API. Using the captured token, the attacker calls CUPS-Create-Local-Printer with a file:// URI (e.g., file:///etc/sudoers.d/pwned) and sets printer-is-shared=true to bypass policy checks. The attacker then sends a print job to this malicious printer queue. cupsd processes the job as root and writes arbitrary content to the specified file, effectively appending a sudoers rule that grants the attacker passwordless root command execution. A proof-of-concept has been published demonstrating this complete attack chain.