CVE-2026-35163 OctoPrint CVE debrief

Who should care

OctoPrint administrators and users who use the web interface to control 3D printers should assess their exposure to this vulnerability and prioritize verification of their instance's version and compensating controls.

Why it matters

CVE-2026-35163 is a medium-severity vulnerability in OctoPrint's web interface that allows an attacker to inject HTML and JavaScript into notification popups, potentially disrupting prints, reading sensitive settings, or performing actions in the victim's session. OctoPrint administrators and users should assess exposure and prioritize verification of their instance's version and compensating controls.

• Disruption of 3D printing operations through injected HTML and JavaScript.
• Potential reading of sensitive settings, such as API keys or printer configurations.
• Possible performance of actions in the victim's OctoPrint session, including changes to printer settings or file uploads.
• Verification of OctoPrint instance version and compensating controls to prevent exploitation.

Technical summary

The vulnerability exists in OctoPrint's web interface, specifically in the PNotify rendering of notification popups. An attacker can inject HTML and JavaScript into the notification by convincing a victim to print a crafted file. This can lead to disruption of prints, reading of sensitive settings, or performing actions in the victim's OctoPrint session. The issue arises from the lack of HTML escaping in the PNotify rendering of notification popups. To mitigate this vulnerability, it is essential to update OctoPrint to versions 1.11.8 or 2.0.0rc3, and implement compensating controls such as input validation and output encoding.

Defensive priority

OctoPrint administrators and users should assess exposure and prioritize verification of their instance's version and compensating controls.

Recommended defensive actions

• Verify OctoPrint instance version and compare to fixed versions 1.11.8 and 2.0.0rc3.
• Assess exposure to potential injection attacks through crafted files.
• Implement compensating controls, such as input validation and output encoding.
• Monitor for suspicious activity and update OctoPrint to fixed versions.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and fixed versions. However, the scope of affected deployments and potential consequences require verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.