Timing Attack Vulnerability in OctoPrint Affects 3D Printer API Key Security

CVE-2026-23892

What is CVE-2026-23892?

OctoPrint, a widely used web interface for managing 3D printers, is vulnerable to a timing attack that could potentially allow an attacker to extract API keys. This vulnerability arises from the method of comparing characters during API key validation, which short-circuits on the first mismatch. Consequently, with network access to an affected instance, attackers can exploit response time variations to guess API keys one character at a time. The flaw affects OctoPrint versions up to 1.11.5 and has been addressed in version 1.11.6. Administrators are advised to secure their OctoPrint instances against access from untrusted networks, particularly the public Internet, to mitigate risks.

References