SB20261109123 - Information Exposure Through Timing Discrepancy in OctoPrint

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109123

SB20261109123 - Information Exposure Through Timing Discrepancy in OctoPrint

Published: November 9, 2026

Security Bulletin ID SB20261109123
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Adjecent network
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Information Exposure Through Timing Discrepancy (CVE-ID: CVE-2026-23892)

CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated adjacent-network attacker to potentially extract valid API keys from OctoPrint.

The vulnerability exists due to character-based comparison in OctoPrint's API key validation that stops at the first mismatched character during authentication. An unauthenticated adjacent-network attacker can infer key characters by timing denied requests under favorable network latency and noise conditions, although successful exploitation has not been demonstrated.


Remediation

Install update from vendor's website.

References