CVE-2026-34990 OpenPrinting CUPS: Local print admin token disclosure using temporary printers
Local attackers can steal admin tokens to create malicious print queues, enabling arbitrary root file overwrites and command execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34990?
CVE-2026-34990 is a medium-severity vulnerability in OpenPrinting cups, published on 3 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable Authorization: Local ... token. That token is enough to drive /admin/ requests on localhost, and the attacker can combine CUPS-Create-Local-Printer with printer-is-shared=true to persist a file:///... queue even though the normal FileDevice policy rejects such URIs. Printing to that queue gives an arbitrary root file overwrite; the PoC below uses that primitive to drop a sudoers fragment and demonstrate root command execution. At time of publication, there are no publicly available patches.
Weakness: CWE-287
Which versions are affected by CVE-2026-34990?
It affects 1 product.
Linux distribution packages (17)
cups SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 2.2.7-150000.3.86.1 |
cups SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 2.2.7-150000.3.86.1 |
cups SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 2.2.7-150000.3.86.1 |
cups SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 2.2.7-150000.3.86.1 |
cups SUSE:Linux Enterprise Micro 5.2 | All versions | 2.2.7-150000.3.86.1 |
cups SUSE:Linux Enterprise Micro 5.3 | All versions | 2.2.7-150000.3.86.1 |
cups SUSE:Linux Enterprise Micro 5.4 | All versions | 2.2.7-150000.3.86.1 |
cups SUSE:Linux Enterprise Micro 5.5 | All versions | 2.2.7-150000.3.86.1 |
cups SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 2.2.7-150000.3.86.1 |
cups SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | All versions | 2.2.7-150000.3.86.1 |
cups SUSE:Linux Enterprise Module for Development Tools 15 SP7 | All versions | 2.2.7-150000.3.86.1 |
cups SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 2.2.7-150000.3.86.1 |
cups SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 2.2.7-150000.3.86.1 |
cups SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 2.2.7-150000.3.86.1 |
cups SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 2.2.7-150000.3.86.1 |
cups SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 2.2.7-150000.3.86.1 |
cups SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 2.2.7-150000.3.86.1 |
Products include Openprinting Cups.
How do I fix CVE-2026-34990?
No fix published yet.
Is CVE-2026-34990 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34990 exists.
Public exploit code: 12 proofs of concept on GitHub.
Other vulnerabilities in OpenPrinting cups
- CVE-2025-58060 cups has Authentication bypass with AuthType Negotiate
- CVE-2026-34978 Path traversal in cups
- CVE-2025-58364 cups: Remote DoS via null dereference
- CVE-2026-34980 OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network
- CVE-2025-61915 OpenPrinting CUPS vulnerable to stack based out-of-bound write
Sources
Also known as ALPINE-CVE-2026-34990, AZL-81825, BELL-CVE-2026-34990, CLSA-2026-1786675343, DEBIAN-CVE-2026-34990, ECHO-f586-616e-6b78 and 5 more.