Live › vulnerability › CVE-2014-125135
Go to dashboardOctoPrint 1.0.0 and 1.1.0 ship a Flask secret key that is hard-coded rather than generated per install. An attacker who knows that key can forge signed session data and may be able to act as a logged-in user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 20:50 UTC. All times on this page are UTC.
Installations running OctoPrint 1.0.0 or 1.1.0 that are reachable from the network. Instances kept off the network and running other versions are not in scope according to the sources.
No product ranges from the sources yet.
octoprint --version on the printer host or check the installed OctoPrint version in the web UI1.0.0 or 1.1.01.11.1 or later, which the sources name as the fixed versionb4699825d6ab92d5451e5b1e3a06dfb81f86e777Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address this issue. The name of the patch is b4699825d6ab92d5451e5b1e3a06dfb81f86e777. The affected component should be upgraded.
This page as .md · .json · in your agent: get_signal("CVE-2014-125135")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.