OpenPrinting CUPS: Divulgation de token d'administrateur local dans CUPS via des imprimantes temporaires

This vulnerability allows a local, unprivileged user to achieve arbitrary root file overwrite. The attack chain involves tricking the CUPS daemon (cupsd) into authenticating to a controlled IPP service using a reusable authorization token. This token then allows the attacker to submit /admin/ requests on localhost. Crucially, combining CUPS-Create-Local-Printer with printer-is-shared=true enables the creation of a persistent file:///... queue, bypassing normal file device policies. Printing to this queue results in arbitrary root file overwrite, effectively granting the attacker complete control over the system’s file system. This is a critical vulnerability due to its potential for complete system compromise.

Systems running CUPS 2.4.16 and earlier are at risk, particularly those with local user accounts. Shared hosting environments utilizing CUPS are also vulnerable, as a compromised user account could potentially exploit this vulnerability to impact the entire host. Legacy systems or those with outdated CUPS installations are especially susceptible.

• linux / server:

journalctl -u cups | grep -i "authorization: local"

• linux / server:

lsof -i :631 | grep -i "attacker-controlled"

• linux / server:

ps aux | grep cupsd | grep -i "ipp://attacker-controlled"

1. 2026-04-03Disclosure

   disclosure

1. Réservé2026-03-31
2. Publiée2026-04-03
3. Modifiée2026-04-06
4. EPSS mis à jour2026-04-11

The primary mitigation is to upgrade CUPS to version 2.4.17 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restricting access to the /admin/ endpoint via firewall rules or access control lists can limit the attack surface. Monitoring CUPS logs for suspicious authentication attempts or printer creation activity is also recommended. While a WAF is unlikely to directly mitigate this, it could potentially detect and block malicious IPP requests. After upgrading, verify the fix by attempting to create a shared printer with a file:/// URI and confirming that the creation fails.