CVE-2026-105326 Red Hat CVE debrief

Who should care

Defenders responsible for CUPS configurations, especially those with email notifications enabled, should assess exposure and prioritize verification and patching. This includes reviewing CUPS configurations, assessing the impact of potential sendmail command-line option injection, and applying patches from Red Hat for affected systems. Security teams and operators managing CUPS deployments should also verify and update their configurations to prevent and

Why it matters

A remote attacker could supply a crafted recipient value to the CUPS mailto notifier, potentially influencing sendmail behavior. Defenders should prioritize verifying CUPS configurations and assessing exposure.

• Potential influence on sendmail behavior through crafted recipient values
• Possible execution of attacker-controlled commands with CUPS service user privileges
• Verification of CUPS configurations and email notification settings required
• Patching and updating CUPS and related systems necessary

Technical summary

The CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. This allows for argument injection, potentially influencing sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.

Defensive priority

Defenders should prioritize verifying CUPS configurations, especially those with email notifications enabled, and assess the impact of potential sendmail command-line option injection.

Recommended defensive actions

• Verify CUPS configurations, especially those with email notifications enabled
• Assess the impact of potential sendmail command-line option injection
• Apply patches from Red Hat for affected systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the argument injection flaw in CUPS. Red Hat has released advisories and patches for affected systems. The flaw is caused by the CUPS scheduler accepting printer subscription requests that supply a mailto notify-recipient-uri, which is then passed to the configured sendmail program without proper validation. This could allow an attacker to influence sendmail behavior. Defenders should verify CUPS configurations and email notification settings, and apply patches from Red Hat for affected.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.