CVE-2024-32977

CriticalCVSS 9.4/10Last modified Jun 17, 2026

Description

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the `autologinLocal` option is enabled within `config.yaml`, even if they come from networks that are not configured as `localNetworks`, spoofing their IP via the `X-Forwarded-For` header. If autologin is not enabled, this vulnerability does not have any impact. The vulnerability has been patched in version 1.10.1. Until the patch has been applied, OctoPrint administrators who have autologin enabled on their instances should disable it and/or to make the instance inaccessible from potentially hostile networks like the internet.

Metrics

CVSS 3.1 9.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-290

Affected software

No affected versions have been published.

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-329786.6Kaminari is a paginator for web app frameworks and object relational mappings. A security vulnerability involving insecure file permissions CVE-2024-329796.1Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a Pos CVE-2024-32987.8Out-Of-Bounds Write and Type Confusion vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2023 through CVE-2024-329809.1Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically config CVE-2024-329815.4Silverstripe framework is the PHP framework forming the base for the Silverstripe CMS. In affected versions a bad actor with access to edit CVE-2024-329828.2Litestar and Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion CVE-2024-329837.5Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of inco CVE-2024-329847.5Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. The Rust implementation of the Yamux stream multiplexer use CVE-2024-329855.9Stellar-core is a reference implementation for the peer-to-peer agent that manages the Stellar network. Prior to 20.4.0, core nodes could be CVE-2024-329869.6PWAsForFirefox is a tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox. Due to improper sanitization of web app CVE-2024-329877.5Microsoft SharePoint Server Information Disclosure Vulnerability CVE-2024-329887.5'OfferBox' App for Android versions 2.0.0 to 2.3.17 and 'OfferBox' App for iOS versions 2.1.7 to 2.6.14 use a hard-coded secret key for JWT.