CVE-2026-23892

CVE-2026-23892 describes a theoretical timing attack vulnerability in OctoPrint versions up to and including 1.11.5, which could allow an attacker to extract API keys. This vulnerability stems from character-based API key validation that short-circuits on the first mismatch, enabling an attacker with network access to infer API keys by measuring response times. The vulnerability is rated Medium severity (CVSS 5.9), indicating a network-based attack with high complexity (AC:H) but potentially high confidentiality impact (C:H) if successful. No user interaction is required, and the attack does not impact integrity or availability. Despite its theoretical nature and the lack of a proven exploit, the vulnerability is patched in OctoPrint version 1.11.6. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.