Information Exposure Through Timing Discrepancy in OctoPrint - CVE-2026-23892

Vulnerability details

The vulnerability allows an unauthenticated adjacent-network attacker to potentially extract valid API keys from OctoPrint.

The vulnerability exists due to character-based comparison in OctoPrint's API key validation that stops at the first mismatched character during authentication. An unauthenticated adjacent-network attacker can infer key characters by timing denied requests under favorable network latency and noise conditions, although successful exploitation has not been demonstrated.

Affected software

How to mitigate CVE-2026-23892

External References

• https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-xg4x-w2j3-57h6

Related Security Bulletins

• Information Exposure Through Timing Discrepancy in OctoPrint