CVE-2024-51493mediumCWE-620

CVE-2024-51493: medium-severity vulnerability in OctoPrint

API key access in settings without reauthentication in OctoPrint

Published

Follow this CVE+ Monitor OctoPrint+ Monitor octoprint

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.3%
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain a vulnerability that allows an attacker that has gained temporary control over an authenticated victim's OctoPrint browser session to retrieve/recreate/delete the user's or - if the victim has admin permissions - the global API key without having to reauthenticate by re-entering the user account's password. An attacker could use a stolen API key to access OctoPrint through its API, or disrupt workflows depending on the API key they deleted. This vulnerability will be patched in version 1.10.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
OctoPrint · OctoPrint
Related CVEs — OctoPrint

In the same product, most dangerous first.

CVE-2025-58180HIGHOctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File UploadEPSS 26.1%CVE-2024-32977HIGHOctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabledEPSS 0.9%CVE-2023-41047MEDIUMImproper Neutralization of Special Elements Used in a Template Engine in OctoPrintEPSS 0.6%CVE-2024-23637MEDIUMOctoPrint Unverified Password Change via Access Control SettingsEPSS 0.5%CVE-2024-28237MEDIUMOctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settingsEPSS 0.4%CVE-2026-23892MEDIUMOctoPrint has Timing Side-Channel Vulnerability in API Key AuthenticationEPSS 0.4%