{"id":"CVE-2014-125135","kind":"vulnerability","aliases":["CVE-2014-125135"],"related":[],"title":"OctoPrint: hard-coded Flask secret key lets remote attackers forge sessions","description":"A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key\r . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address this issue. The name of the patch is b4699825d6ab92d5451e5b1e3a06dfb81f86e777. The affected component should be upgraded.","summary":"OctoPrint 1.0.0 and 1.1.0 ship a Flask secret key that is hard-coded rather than generated per install. An attacker who knows that key can forge signed session data and may be able to act as a logged-in user.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["3d-printing","octoprint","package","self-hosted"],"not_affected_if":["other-versions"],"how_to_check":"- Run `octoprint --version` on the printer host or check the installed OctoPrint version in the web UI\n- Confirm whether the version is `1.0.0` or `1.1.0`","fix":"- Upgrade OctoPrint to `1.11.1` or later, which the sources name as the fixed version\n- Reference patch commit `b4699825d6ab92d5451e5b1e3a06dfb81f86e777`","status":"open","published_at":"2026-10-26T20:17:09+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","triaged_at":"2026-10-26T20:51:37+00:00","updated_at":"2026-10-26T20:51:37+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T20:51:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OctoPrint to `1.11.1` or later, which the sources name as the fixed version\n- Reference patch commit `b4699825d6ab92d5451e5b1e3a06dfb81f86e777`","reach":"network","title":"OctoPrint: hard-coded Flask secret key lets remote attackers forge sessions","impact":"medium","summary":"OctoPrint 1.0.0 and 1.1.0 ship a Flask secret key that is hard-coded rather than generated per install. An attacker who knows that key can forge signed session data and may be able to act as a logged-in user.","category":"package","nicknames":[],"who_cares":["octoprint","self-hosted","3d-printing"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker forges session cookies and takes over the printer interface","analyst_note":"Check the NVD entry and the OctoPrint release notes to confirm whether the forged session grants full admin access and whether any workaround exists short of upgrading.","how_to_check":"- Run `octoprint --version` on the printer host or check the installed OctoPrint version in the web UI\n- Confirm whether the version is `1.0.0` or `1.1.0`","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Installations running OctoPrint 1.0.0 or 1.1.0 that are reachable from the network. Instances kept off the network and running other versions are not in scope according to the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00061,"input_tokens":3367,"output_tokens":547,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125135':15A,18A '-2014':14A,17A '/1.1.0':78C '1.0.0':28B,77C '1.1.0':30B '1.11.1':112C '3d':20B '3d-printing':19B 'abl':60B,114C 'act':62B 'address':116C 'affect':79C,127C 'attack':10A,47B,103C 'b4699825d6ab92d5451e5b1e3a06dfb81f86e777':125C 'code':4A,40B,99C 'compon':86C,128C 'cryptograph':100C 'cve':13A,16A 'data':56B 'detect':74C 'flask':5A,33B,87C 'forg':11A,53B 'function':83C 'generat':43B 'handler':90C 'hard':3A,39B,98C 'hard-cod':2A,38B,97C 'host':26B 'instal':45B 'issu':118C 'key':7A,35B,51B,89C,101C 'know':49B 'lead':93C 'let':8A 'log':66B 'logged-in':65B 'manipul':92C 'may':58B,104C 'name':120C 'octoprint':1A,22B,27B,76C 'packag':23B 'patch':123C 'per':44B 'perform':106C 'print':21B 'rather':41B 'remot':9A,108C 'secret':6A,34B,88C 'secur':70C 'self':25B 'self-host':24B 'session':12A,55B 'ship':31B 'sign':54B 'unknown':82C 'upgrad':109C,131C 'use':95C 'user':68B 'version':111C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Installations running OctoPrint 1.0.0 or 1.1.0 that are reachable from the network. Instances kept off the network and running other versions are not in scope according to the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T20:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2014-125135","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-125135","severity":null,"published_at":"2026-10-26T20:17:09+00:00","modified_at":"2026-10-26T20:17:10+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","fetched_at":"2026-10-26T20:50:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}