CVE-2026-23892

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up to and including 1.11.5 are affected by a (theoretical) timing attack vulnerability that allows API key extraction over the network. Due to using character based comparison that short-circuits on the first mismatched character during API key validation, rather than a cryptographical method with static runtime regardless of the point of mismatch, an attacker with network based access to an affected OctoPrint could extract API keys valid on the instance by measuring the response times of the denied access responses and guess an API key character by character. The vulnerability is patched in version 1.11.6. The likelihood of this attack actually working is highly dependent on the network's latency, noise and similar parameters. An actual proof of concept was not achieved so far. Still, as always administrators are advised to not expose their OctoPrint instance on hostile networks, especially not on the public Internet.

• CWE-208

• https://github.com/OctoPrint/OctoPrint/commit/249fd80ab01bc4b7dabedff768230a0fb5d01a8cPatch
• https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.6Product, Release Notes
• https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-xg4x-w2j3-57h6Vendor Advisory

Published

Jan 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23887Group-Office is an enterprise customer relationship manageme…5.4
• CVE-2026-23888pnpm is a package manager. Prior to version 10.28.1, a path …6.5
• CVE-2026-23889pnpm is a package manager. Prior to version 10.28.1, a path …6.5
• CVE-2026-2389The Complianz – GDPR/CCPA Cookie Consent plugin for WordPres…4.9
• CVE-2026-23890pnpm is a package manager. Prior to version 10.28.1, a path …6.5
• CVE-2026-23891Decidim is a participatory democracy framework. In versions …8.7
• CVE-2026-23893openCryptoki is a PKCS#11 library and provides tooling for L…6.8
• CVE-2026-23896immich is a high performance self-hosted photo and video man…8.8
• CVE-2026-23897Apollo Server is an open-source, spec-compliant GraphQL serv…7.5
• CVE-2026-23898Lack of input validation leads to an arbitrary file deletion…7.2
• CVE-2026-23899An improper access check allows unauthorized access to webse…8.8
• CVE-2026-23900Various stored XSS vulnerabilities in the maps- and icon ren…6.5