Web Interface Vulnerability in OctoPrint by Forwrding, Inc.
CVE-2026-123364

2.4LOW

Key Information:

Vendor

Octoprint

Status
Octoprint
Vendor
CVE Published:
9 November 2026

What is CVE-2026-123364?

OctoPrint, a web-based interface for managing consumer 3D printers, is susceptible to a Cross-Site Scripting (XSS) vulnerability in versions from 2.0.0rc1 to 2.0.0rc6. An authenticated user can manipulate connection parameters like the port and baud rate when suggesting a connection. These crafted defaults are stored in the system and subsequently rendered as HTML when accessed by other users, thereby allowing for script execution in their browsers and unauthorized actions within their OctoPrint instances. The issue is resolved in version 2.0.0rc7.

Affected Version(s)

OctoPrint >= 2.0.0rc1, < 2.0.0rc7

References

https://github.com/OctoPrint/OctoPrint/security/advisorie...
x_refsource_CONFIRM
https://github.com/OctoPrint/OctoPrint/commit/059495787a1...
x_refsource_MISC
https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc7
x_refsource_MISC

CVSS V4

Score:
2.4
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.