OCTOPRINT · CVE-2026-123364 · Other
NO FIX YET · SEE WHAT TO DO
An authenticated OctoPrint user can save a crafted default port or baudrate through the Serial Connector plugin, and OctoPrint renders it unescaped as HTML. When another user views the saved connection parameters, the script runs in their browser with their OctoPrint access.
first public Oct 20, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Exposure requires an OctoPrint instance in the 2.0.0rc1 to 2.0.0rc6 range where the Serial Connector plugin handles connect requests. Any user with an account can plant the payload, so the risk is highest on shared print servers with several users. Single-user installs with no other accounts are lower risk.
Not affected if default-config, single-user
Who cares 3d-printing, octoprint, self-hosted, serial-connector
octoprint --version or the version shown in Settings) and see whether it is between 2.0.0rc1 and 2.0.0rc6.2.0.0rc7 or later.OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user can supply a crafted default port or baudrate through a connect request to the bundled Serial Connector plugin. OctoPrint persists these values in printerConnection.preferred.parameters.port or printerConnection.preferred.parameters.baudrate and renders them as HTML when another user views the saved connection parameters, allowing script execution in that user's browser and actions within the user's OctoPrint access. This issue is fixed in version 2.0.0rc7.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.