Read the docs
TI-2022-02616 Aliases CVE-2022-2822GHSA-5w5x-q9p5-9qg3

Authentication Bypass by Primary Weakness in octoprint/octoprint

Priority LOW 35CWE-307Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-307.

Summary

An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts.

Why it matters now

EPSS 0.00893 59th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed octoprint/octoprint (octoprint): 1.9.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
OctoPrintoctoprint/octoprintbefore 1.9.01.9.0Patch availableCNA
—OctoPrint (PyPI)up to 1.7.3—No fix listedGHSA-5w5x-q9p5-9qg3
  • octoprint/octoprint VendorOctoPrint Affected before 1.9.0 Fixed in 1.9.0 Patch available CNA
  • OctoPrint (PyPI) Vendor— Affected up to 1.7.3 Fixed in — No fix listed GHSA-5w5x-q9p5-9qg3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:octoprint:octoprint:*:*:*:*:*:*:*:*before 1.9.0VulnerableOctoPrint
  • cpe:2.3:a:octoprint:octoprint:*:*:*:*:*:*:*:* Versions before 1.9.0 Vulnerable ·OctoPrint

Remediation

  • Fix · CNA octoprint/octoprint (octoprint) Fixed in 1.9.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2822
  2. 2026-10-03 Alias added: GHSA-5w5x-q9p5-9qg3

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2022-02830 Improper Privilege Management in octoprint/octoprint CVSS 3.1HIGH 8.8
  • TI-2022-03320 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprint CVSS 3.1MEDIUM 6.0
  • TI-2022-02664 Unrestricted Upload of File with Dangerous Type in octoprint/octoprint CVSS 3.1MEDIUM 5.4
  • TI-2025-35988 OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload CVSS 4.0HIGH 7.5
  • TI-2024-18796 OctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settings CVSS 3.1MEDIUM 4.8
  • TI-2022-02678 Insufficient Session Expiration in octoprint/octoprint CVSS 3.1MEDIUM 4.4
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences