Read the docs
TI-2026-27212 Aliases CVE-2026-34990

OpenPrinting CUPS: Local print admin token disclosure using temporary printers

Priority MEDIUM 58CWE-287Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 1 fixed, 6 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-287.

Summary

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable Authorization: Local ... token. That token is enough to drive /admin/ requests on localhost, and the attacker can combine CUPS-Create-Local-Printer with printer-is-shared=true to persist a file:///... queue even though the normal FileDevice policy rejects such URIs. Printing to that queue gives an arbitrary root file overwrite; the PoC below uses that primitive to drop a sudoers fragment and demonstrate root command execution. At time of publication, there are no publicly available patches.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00295 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenPrintingcupsup to 2.4.16—No fix listedCNA
  • cups VendorOpenPrinting Affected up to 2.4.16 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*up to 2.4.16VulnerableOpenPrinting
  • cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:* Versions up to 2.4.16 Vulnerable ·OpenPrinting

Remediation

Red Hat 1 advisory

  • RHSA-2026:8814 Released 2026-04-17 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images cups-2.4.17-1.hum1@aarch64, cups-2.4.17-1.hum1@src, cups-2.4.17-1.hum1@x86_64 +14

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:8814

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34990

References

Exploit 1

  • TI-2025-35903 cups has Authentication bypass with AuthType Negotiate CVSS 3.1HIGH 8.0
  • TI-2023-17077 CUPS vulnerable to use-after-free in cupsdAcceptClient() CVSS 3.1HIGH 7.1
  • TI-2026-27200 Path traversal in OpenPrinting cups CVSS 3.1MEDIUM 6.5
  • TI-2023-04157 OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow CVSS 3.1HIGH 7.0
  • TI-2026-74874 Path traversal in OpenPrinting CUPS banner handling discloses files CVSS 3.1MEDIUM 5.3
  • TI-2026-27201 OpenPrinting CUPS: Heap overflow in `get_options()` CVSS 3.1MEDIUM 5.3
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences