CVE-2024-32977

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the `autologinLocal` option is enabled within `config.yaml`, even if they come from networks that are not configured as `localNetworks`, spoofing their IP via the `X-Forwarded-For` header. If autologin is not enabled, this vulnerability does not have any impact. The vulnerability has been patched in version 1.10.1. Until the patch has been applied, OctoPrint administrators who have autologin enabled on their instances should disable it and/or to make the instance inaccessible from potentially hostile networks like the internet.

• CWE-290
• CWE-290

• https://github.com/OctoPrint/OctoPrint/commit/5afbec8d23508edc25b0f1bdef1620580136add4Patch
• https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-2vjq-hg5w-5gm7Exploit, Vendor Advisory
• https://github.com/OctoPrint/OctoPrint/commit/5afbec8d23508edc25b0f1bdef1620580136add4Patch
• https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-2vjq-hg5w-5gm7Exploit, Vendor Advisory

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32971Apollo Router is a configurable, graph router written in Rus…9
• CVE-2024-32972go-ethereum (geth) is a golang execution layer implementatio…7.5
• CVE-2024-32973Pluto is a superset of Lua 5.4 with a focus on general-purpo…4.8
• CVE-2024-32974Envoy is a cloud-native, open source edge and service proxy.…7.5
• CVE-2024-32975Envoy is a cloud-native, open source edge and service proxy.…7.5
• CVE-2024-32976Envoy is a cloud-native, open source edge and service proxy.…7.5
• CVE-2024-32978Kaminari is a paginator for web app frameworks and object re…6.6
• CVE-2024-32979Nautobot is a Network Source of Truth and Network Automation…6.1
• CVE-2024-3298Out-Of-Bounds Write and Type Confusion vulnerabilities exist…7.8
• CVE-2024-32980Spin is the developer tool for building and running serverle…9.1
• CVE-2024-32981Silverstripe framework is the PHP framework forming the base…5.4
• CVE-2024-32982Litestar and Starlite is an Asynchronous Server Gateway Inte…8.2