CVE-2018-16710 Information disclosure in n/a
Remote attackers can obtain sensitive information or cause denial of service if OctoPrint is exposed to the public internet.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-16710?
CVE-2018-16710 is a critical vulnerability in n/a, published on 7 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests on port 8081. NOTE: the vendor disputes the significance of this report because their documentation states that with "blind port forwarding ... Putting OctoPrint onto the public internet is a terrible idea, and I really can't emphasize that enough.
Weakness: CWE-200
Which versions are affected by CVE-2018-16710?
It affects 1 product.
Products include Octoprint Octoprint.
How do I fix CVE-2018-16710?
No fix has been published for CVE-2018-16710 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-16710 being exploited?
There is no known exploitation of CVE-2018-16710 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2025-58180 OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
- CVE-2022-1430 Cross-site Scripting (XSS) - DOM in octoprint/octoprint
- CVE-2022-1432 Cross-site Scripting (XSS) - Generic in octoprint/octoprint
- CVE-2024-32977 OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled
- CVE-2025-48879 OctoPrint Vulnerable to Denial of Service through malformed HTTP request
Sources
Also known as GHSA-pjx7-3rv2-9x45.