LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23892: OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up to and including 1.11.5 are affected by a (theoretical) timing attack vulnerability that allows API key extraction over the network. Due to using character based comparison that short-circuits on the first mismatched character during API key validation, rather than a cryptographical method with static runtime regardless of the point of mismatch, an attacker with network based access to an affected OctoPrint could extract API keys valid on the instance by measuring the response times of the denied access responses and guess an API key character by character. The vulnerability is patched in version 1.11.6. The likelihood of this attack actually working is highly dependent on the network's latency, noise and similar parameters. An actual proof of concept was not achieved so far. Still, as always administrators are advised to not expose their OctoPrint instance on hostile networks, especially not on the public Internet.

MediumCVSS 6Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

OctoPrint before 1.11.6 used an API key check that could leak information through tiny timing differences. In theory, someone with network access could recover a valid API key. The vendor says no working proof of concept has been achieved and success depends heavily on network conditions.

Executive priority

Treat this as a medium-priority maintenance update. It is not reported as exploited, but OctoPrint controls physical 3D printers and should not be internet-exposed. Prioritize upgrading exposed or remotely reachable instances first.

Technical view

CVE-2026-23892 is a CWE-208 timing side-channel in OctoPrint API key authentication. A character-by-character comparison short-circuits on mismatch instead of using constant-time comparison. A network attacker could potentially infer API keys from response timing. Affected versions are OctoPrint below 1.11.6; the fix is in 1.11.6.

Likely exposure

Exposure is limited to OctoPrint instances reachable by an attacker, especially those exposed to untrusted networks or the public Internet. The CVSS vector indicates adjacent-network attack requirements, high attack complexity, and no required privileges or user interaction.

Exploitation context

No active exploitation is indicated by the provided sources, and this CVE is not listed as KEV. The advisory describes the attack as theoretical and states no actual proof of concept was achieved. Real-world feasibility depends on latency, noise, and similar network conditions.

Researcher notes

The key uncertainty is practical exploitability over real networks. The vendor’s description emphasizes timing noise and lack of a working PoC. Researchers should focus on version verification, exposure mapping, and confirming the constant-time comparison fix rather than attempting key extraction.

Mitigation direction

  • Upgrade OctoPrint to version 1.11.6 or later.
  • Do not expose OctoPrint to hostile networks or the public Internet.
  • Restrict access to trusted networks or authenticated remote-access paths.
  • Review vendor guidance for any additional hardening recommendations.

Validation and detection

  • Inventory OctoPrint instances and record their versions.
  • Confirm all instances are running OctoPrint 1.11.6 or later.
  • Verify OctoPrint is not publicly reachable unless intentionally secured.
  • Review network controls limiting access to trusted users and networks.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-208: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-23892 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6CVSS 4.0MediumCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N——Primary CVE score

Vulnerability scoring details

Base CVSS 4.0 score

6Medium
CVSS 4.0 vector shape for CVE-2026-23892Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
OctoPrintOctoPrint< 1.11.6Listed
Weakness

CWE details

CWE-208

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-208 · source CWE mapping

Observable Timing Discrepancy

Observable Timing Discrepancy represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs