Detections
Analytics

SCA: security update for OctoPrint (GHSA-xg4x-w2j3-57h6)

medium Tenable Cloud Security Plugin ID 437130

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up to and
 including 1.11.5 are affected by a (theoretical) timing attack vulnerability that allows API key
 extraction over the network. Due to using character based comparison that short-circuits on the first
 mismatched character during API key validation, rather than a cryptographical method with static runtime
 regardless of the point of mismatch, an attacker with network based access to an affected OctoPrint could
 extract API keys valid on the instance by measuring the response times of the denied access responses and
 guess an API key character by character. The vulnerability is patched in version 1.11.6. The likelihood of
 this attack actually working is highly dependent on the network's latency, noise and similar parameters.
 An actual proof of concept was not achieved so far. Still, as always administrators are advised to not
 expose their OctoPrint instance on hostile networks, especially not on the public Internet.
 (CVE-2026-23892)

See Also

https://github.com/advisories/GHSA-xg4x-w2j3-57h6

Plugin Details

Severity: Medium

ID: 437130

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 1/27/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-23892

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6

Threat Score: 2.3

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/27/2026

Vulnerability Publication Date: 1/27/2026

Reference Information

CVE: CVE-2026-23892

cwe: CWE-208