CVE-2013-10077
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
OctoPrint version 1.0.0 has a vulnerability in the getSettings function in src/octoprint/server/ajax/settings.py, in the API Key Handler component. The manipulation causes information disclosure, and the attack can be carried out remotely. The exploit is publicly available, and the issue is fixed in version 1.1.0-rc1.
Risk Assessment
An attacker can remotely access sensitive information, potentially including API keys. This may lead to further compromise of the system.
Recommendation
Update OctoPrint to version 1.1.0-rc1 or later. Check whether API keys have been exposed and rotate them if necessary.
Other vulnerabilities in OctoPrint
See all- CVE-2025-58180High
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename becomes included in a command defined in a system event handler and said event gets triggered. If no event handlers executing system commands with uploaded filenames as parameters have been configured, this vulnerability does not have an impact. The vulnerability is patched in version 1.11.3.
- CVE-2014-125135High
A vulnerability was detected in OctoPrint 1.0.0/1.1.0 in the Flask Secret Key Handler component, involving the use of a hard-coded cryptographic key. The attack may be performed remotely. The issue is fixed in version 1.11.1 (patch b4699825d6ab92d5451e5b1e3a06dfb81f86e777).
- CVE-2026-54134High
OctoPrint before versions 1.11.8 and 2.0.0rc3 has a parsing discrepancy between its custom Tornado upload handler and Flask/Werkzeug, allowing an attacker with FILE_UPLOAD permission to inject reserved internal upload fields via query parameters or parser differentials. Affected endpoints include /api/files/{local|sdcard}, /api/languages, /plugin/backup/restore, and /plugin/pluginmanager/upload_file.
- CVE-2026-35163Medium
OctoPrint prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML escaping. An attacker who convinces a victim to print a crafted file can inject HTML and JavaScript into the notification, disrupt prints, read information available to the victim including sensitive settings when permitted, or perform actions in the victim's OctoPrint session.
Original NVD description (English source)
A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.1.0-rc1 will fix this issue. Patch name: eccc9d6fbde0c46cdd6e255fd5ce9a30077ba954. You should upgrade the affected component. Affected is a 2013 release where access control was not yet implemented and the endpoint was part of first-run setup). The API key has been admin-gated since 1.2.0 and GET /api/settings is protected by Permissions.SETTINGS_READ plus reauthentication in all current releases.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS