CVE-2026-123364 OctoPrint: Stored XSS via saved connection parameters
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-123364?
CVE-2026-123364 is a low-severity vulnerability in OctoPrint, published on 9 Nov 2026.
Official description
OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user can supply a crafted default port or baudrate through a connect request to the bundled Serial Connector plugin. OctoPrint persists these values in printerConnection.preferred.parameters.port or printerConnection.preferred.parameters.baudrate and renders them as HTML when another user views the saved connection parameters, allowing script execution in that user's browser and actions within the user's OctoPrint access. This issue is fixed in version 2.0.0rc7.
Weakness: CWE-79
Which versions are affected by CVE-2026-123364?
1 open source package ship an affected version, including OctoPrint.
| Package | Affected | Fixed in |
|---|---|---|
OctoPrint PyPI | From 2.0.0rc1 | 2.0.0rc7 |
How do I fix CVE-2026-123364?
Upgrade OctoPrint to 2.0.0rc7 or later.
Is CVE-2026-123364 being exploited?
There is no known exploitation of CVE-2026-123364 in the wild and no public exploit code.
Sources
Also known as GHSA-p623-mxf7-qxjm.