CVE-2026-34990
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
OpenPrinting CUPS versions 2.4.16 and earlier contain a vulnerability that allows a local unprivileged user to coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable `Authorization: Local ...` token. This token enables /admin/ requests on localhost, and the attacker can create a persistent printer queue with a file:///... URI despite the FileDevice policy. Printing to that queue allows arbitrary root file overwrite, potentially leading to privilege escalation.
Risk Assessment
A local attacker can gain root privileges by overwriting system files, such as a sudoers fragment, enabling arbitrary command execution as root.
Recommendation
Monitor for patches from OpenPrinting and temporarily restrict access to the CUPS service to trusted users only.
Other vulnerabilities in CUPS
See all- CVE-2024-47175Medium
Vulnerability in the libppd library used by CUPS. The ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer, potentially leading to buffer overflow or other issues.
- CVE-2024-35235Medium
Vulnerability in CUPS printing system versions 2.4.8 and earlier. When starting the cupsd server with a Listen configuration pointing to a symbolic link, the process can perform an arbitrary chmod on the target file.
- CVE-2026-34980High
OpenPrinting CUPS versions 2.4.16 and prior have a vulnerability in a network-exposed cupsd with a shared PostScript queue. An unauthenticated client can send a print job, and the server processes a page-border value with an embedded newline, allowing execution of an arbitrary binary (e.g., /usr/bin/vim) as user lp.
- CVE-2026-34979Medium
OpenPrinting CUPS up to version 2.4.16 has a heap-based buffer overflow in the CUPS scheduler when building filter option strings from job attributes. At the time of publication, no public patches are available.
- CVE-2026-34978Medium
In OpenPrinting CUPS versions 2.4.16 and prior, the RSS notifier allows path traversal in notify-recipient-uri, enabling a remote IPP client to write RSS XML bytes outside CacheDir/rss to any lp-writable location. By exploiting default group-writable permissions (root:lp, mode 0770), the notifier running as lp can overwrite root-managed state files, causing job cache parsing failures and loss of queued jobs after cupsd restart.
- CVE-2026-27447Medium
OpenPrinting CUPS versions 2.4.16 and prior contain an authorization bypass vulnerability due to case-insensitive username comparison. This allows an unprivileged user to gain unauthorized access to restricted operations by using a username that differs only in case from an authorized user. No public patches are available at the time of publication.
Original NVD description (English source)
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable Authorization: Local ... token. That token is enough to drive /admin/ requests on localhost, and the attacker can combine CUPS-Create-Local-Printer with printer-is-shared=true to persist a file:///... queue even though the normal FileDevice policy rejects such URIs. Printing to that queue gives an arbitrary root file overwrite; the PoC below uses that primitive to drop a sudoers fragment and demonstrate root command execution. At time of publication, there are no publicly available patches.