Red Hat EUVD-2026-18889

OpenPrinting CUPS is a printing system daemon (cupsd) that handles IPP (Internet Printing Protocol) requests and manages printer queues. The vulnerability exploits a flaw in CUPS' authentication token handling and authorization policy enforcement (CWE-287: Improper Authentication). A local attacker can set up a rogue localhost IPP service to intercept cupsd's outbound authentication requests, capture the Authorization: Local token, and replay it to access administrative endpoints. The attack chain leverages two policy gaps: (1) CUPS generates reusable authentication tokens for localhost connections without sufficient scope restriction, and (2) the printer-is-shared=true parameter in CUPS-Create-Local-Printer requests bypasses the normal FileDevice URI policy that would reject file:/// schemes. This allows creation of persistent printer queues pointing to arbitrary filesystem paths. When a print job is sent to such a queue, cupsd executes it as root, enabling arbitrary file writes. The affected component is cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:* (all versions through 2.4.16).