CVE-2026-123364: OctoPrint: Stored XSS via saved connection parameters

Q: Who can exploit this issue, and what user interaction is required?

An authenticated user must be able to submit a crafted default port or baudrate in a connection request through the bundled Serial Connector plugin. Exploitation requires another user to view the saved connection parameters.

Q: Which deployments are affected?

OctoPrint versions from 2.0.0rc1 through 2.0.0rc7 are identified as affected. The issue is fixed in version 2.0.0rc7.

Q: What can the injected script do?

The script executes in the browser of the user viewing the saved parameters and can perform actions within that user's OctoPrint access. The practical impact depends on the permissions of the viewing user.

Q: How can an administrator check for possible exploitation?

Review saved printer connection settings for unexpected or suspicious values in printerConnection.preferred.parameters.port and printerConnection.preferred.parameters.baudrate. These are the fields where the crafted values are persisted.

Published Nov 9, 2026

Updated

OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user can supply a crafted default port or baudrate through a connect request to the bundled Serial Connector plugin. OctoPrint persists these values in printerConnection.preferred.parameters.port or printerConnection.preferred.parameters.baudrate and renders them as HTML when another user views the saved connection parameters, allowing script execution in that user's browser and actions within the user's OctoPrint access. This issue is fixed in version 2.0.0rc7.

Affected Software

1 affected component

OctoPrint OctoPrint>=2.0.0rc1<2.0.0rc7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OctoPrint to a version that resolves this vulnerability.
Fixed in 2.0.0rc7

Event History

Nov 9, 2026

CVE Published

via MITRE·05:10 PM

Data Sourced

via MITRE·05:10 PM

DescriptionWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue, and what user interaction is required?

An authenticated user must be able to submit a crafted default port or baudrate in a connection request through the bundled Serial Connector plugin. Exploitation requires another user to view the saved connection parameters.

Which deployments are affected?

OctoPrint versions from 2.0.0rc1 through 2.0.0rc7 are identified as affected. The issue is fixed in version 2.0.0rc7.

What can the injected script do?

The script executes in the browser of the user viewing the saved parameters and can perform actions within that user's OctoPrint access. The practical impact depends on the permissions of the viewing user.

How can an administrator check for possible exploitation?

Review saved printer connection settings for unexpected or suspicious values in printerConnection.preferred.parameters.port and printerConnection.preferred.parameters.baudrate. These are the fields where the crafted values are persisted.

CVE-2026-123364: OctoPrint: Stored XSS via saved connection parameters

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue, and what user interaction is required?

Which deployments are affected?

What can the injected script do?

How can an administrator check for possible exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and what user interaction is required?

Which deployments are affected?

What can the injected script do?

How can an administrator check for possible exploitation?