CVE-2026-94490: OctoPrint Command API system.py executeSystemCommand os command injection
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: In the versions that have this feature, they are an admin-gated, admin-defined, by-design shell-command feature that is not an exploitable injection.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector lists privileges required as high, so the attacker needs high-level privileges before they can exploit the Command API remotely. User interaction is not required.
Is public exploit code available?
Yes. The disclosure states that an exploit has been released publicly and may be used in attacks.
Which deployments are known to be affected?
The reported affected product is OctoPrint version 1.0.0, specifically the Command API function executeSystemCommand in src/octoprint/server/api/system.py. The supplied information does not identify other affected versions or configuration-dependent exposure.