Medium 5.3Published Oct 26, 2026

CVE-2013-10077OctoPrint API Key settings.py getSettings information disclosure

Updated under an hour ago (Oct 29, 2026, 11:10 AM ET)

Does this affect you?

It affects n/a OctoPrint. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for n/a OctoPrint

Exploited in the last 30 days

A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.1.0-rc1 will fix this issue. Patch name: eccc9d6fbde0c46cdd6e255fd5ce9a30077ba954. You should upgrade the affected component. Affected is a 2013 release where access control was not yet implemented and the endpoint was part of first-run setup). The API key has been admin-gated since 1.2.0 and GET /api/settings is protected by Permissions.SETTINGS_READ plus reauthentication in all current releases.

CVSS: 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
Weakness (CWE): CWE-200, CWE-284
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulDB
NVD analysis: Deferred
Record last updated: Oct 26, 2026
First seen by InfoSec Signals: Oct 26, 2026

Affected products

Affected products

n/a OctoPrint octoprint:octoprint	1.0.0; 1.1.0-rc1 not affected	CNA record

References

References

https://vuldb.com/vuln/426128	vdb-entry, technical-description
https://vuldb.com/vuln/426128/cti	signature, permissions-required
https://vuldb.com/cve/CVE-2013-10077	third-party-advisory
https://vuldb.com/submit/994544	third-party-advisory
https://github.com/OctoPrint/OctoPrint/commit/eccc9d6fbde0c46cdd6e255fd5ce9a30077ba954	patch
https://github.com/OctoPrint/OctoPrint/releases/tag/1.1.0-rc1	patch
https://github.com/OctoPrint/OctoPrint/	product

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.