Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.0
CVE-2026-94490: OctoPrint lets remote users run system commands
CVE-2026-94490 · published 28 days ago
Summary
OctoPrint version 1.0.0 includes a function that can be tricked into running any command on the host computer. An attacker who can reach the Command API could execute commands, potentially taking control of the machine. Apply the latest OctoPrint update or disable the Command API until the issue is fixed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| – | octoprint | 1.0.0 |
Original advisory text
OctoPrint Command API system.py executeSystemCommand os command injection
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: In the versions that have this feature, they are an admin-gated, admin-defined, by-design shell-command feature that is not an exploitable injection.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-77Command Injection
CWE-78OS Command Injection
Timeline
Published22 Sep 2026
Updated13 Oct 2026
First seen22 Sep 2026
Track software like this
Free during beta