Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-23892— OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication

Quick assessment

Affected
OctoPrint OctoPrint
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OctoPrint是OctoPrint开源的一个应用程序。提供了一个快速的Web界面，用于控制消费类3D打印机。 OctoPrint 1.11.5及之前版本存在安全漏洞，该漏洞源于API密钥验证使用基于字符的比较，可能导致通过网络进行定时攻击以提取API密钥。

AI Predicted 5.3 Difficulty: Theoretical EPSS 0.44% · P36

Possible ATT&CK Techniques 1 AI

T1590 · Gather Victim Network Information
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-23892

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication
Source: CVE Program / CVE List V5
Vulnerability Description
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up to and including 1.11.5 are affected by a (theoretical) timing attack vulnerability that allows API key extraction over the network. Due to using character based comparison that short-circuits on the first mismatched character during API key validation, rather than a cryptographical method with static runtime regardless of the point of mismatch, an attacker with network based access to an affected OctoPrint could extract API keys valid on the instance by measuring the response times of the denied access responses and guess an API key character by character. The vulnerability is patched in version 1.11.6. The likelihood of this attack actually working is highly dependent on the network's latency, noise and similar parameters. An actual proof of concept was not achieved so far. Still, as always administrators are advised to not expose their OctoPrint instance on hostile networks, especially not on the public Internet.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过时间差异性导致的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
OctoPrint 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OctoPrint是OctoPrint开源的一个应用程序。提供了一个快速的Web界面，用于控制消费类3D打印机。 OctoPrint 1.11.5及之前版本存在安全漏洞，该漏洞源于API密钥验证使用基于字符的比较，可能导致通过网络进行定时攻击以提取API密钥。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
OctoPrint OctoPrint < 1.11.6 -

II. Public POCs for CVE-2026-23892

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-23892

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-23892 (1)

IV. Related Vulnerabilities

Same product: OctoPrint
Same vendor: OctoPrint
Same weakness: CWE-208

V. Comments for CVE-2026-23892

No comments yet

Leave a comment