Skip to content
OpenAdvisories
Medium · 5.0 Public exploit CVE-2026-34990 EUVD-2026-18889

OpenPrinting CUPS: Local print admin token disclosure using temporary printers

Published Apr 3, 2026 · Updated Apr 6, 2026 · Assigned by GitHub_M

Vendor: OpenPrinting Product: cups Package: cups Package: cups Package: cups Package: cups Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable Authorization: Local ... token. That token is enough to drive /admin/ requests on localhost, and the attacker can combine CUPS-Create-Local-Printer with printer-is-shared=true to persist a file:///... queue even though the normal FileDevice policy rejects such URIs. Printing to that queue gives an arbitrary root file overwrite; the PoC below uses that primitive to drop a sudoers fragment and demonstrate root command execution. At time of publication, there are no publicly available patches.

Affected products

VendorProductAffectedFixed
OpenPrinting cups <= 2.4.16 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 cups 2.4.17-1 —
Debian 13 cups No fix yet —
Debian 12 cups No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS cups 2.4.16-1ubuntu1.2 USN-8405-1
Ubuntu 25.10 cups 2.4.12-0ubuntu3.9 USN-8405-1
Ubuntu 24.04 LTS cups 2.4.7-1.2ubuntu7.13 USN-8405-1
Ubuntu 22.04 LTS cups 2.4.1op1-1ubuntu4.20 USN-8405-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS cups No fix yet —
Ubuntu Pro 18.04 LTS cups No fix yet —
Ubuntu Pro 16.04 LTS cups No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 cups +7 2.4.17-1.hum1 RHSA-2026:8814

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 cups 2.2.7-150000.3.86.1 SUSE-SU-2026:1399-1
SLES 15 SP6 cups 2.2.7-150000.3.86.1 SUSE-SU-2026:1399-1
SLES 15 SP5 cups 2.2.7-150000.3.86.1 SUSE-SU-2026:1399-1
SLES 15 SP4 cups 2.2.7-150000.3.86.1 SUSE-SU-2026:1399-1
SLES 12 SP5 cups 1.7.5-20.62.1 SUSE-SU-2026:1617-1
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 cups 2.2.7-150000.3.86.1 SUSE-SU-2026:1399-1
SLES for SAP 15 SP5 cups 2.2.7-150000.3.86.1 SUSE-SU-2026:1399-1
SLES for SAP 15 SP4 cups 2.2.7-150000.3.86.1 SUSE-SU-2026:1399-1
SLE Micro 5.5 cups 2.2.7-150000.3.86.1 SUSE-SU-2026:1399-1
SLE Micro 5.4 cups 2.2.7-150000.3.86.1 SUSE-SU-2026:1399-1
SLE Micro 5.3 cups 2.2.7-150000.3.86.1 SUSE-SU-2026:1399-1
SLE Micro 5.2 cups 2.2.7-150000.3.86.1 SUSE-SU-2026:1399-1
SLE HPC 15 SP5 cups 2.2.7-150000.3.86.1 SUSE-SU-2026:1399-1
SLE HPC 15 SP4 cups 2.2.7-150000.3.86.1 SUSE-SU-2026:1399-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed cups 2.4.17-1.1 openSUSE-SU-2026:10589-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 cups 2.4.18-r0 —
Alpine v3.23 cups 2.4.18-r0 —
Alpine v3.22 cups 2.4.18-r0 —
Alpine v3.21 cups 2.4.18-r0 —
Alpine v3.20 cups 2.4.18-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 cups +7 1:2.4.16-1.amzn2023.0.3 ALAS2023-2026-1635
Amazon Linux 2 cups +6 1:1.6.3-51.amzn2.0.9 ALAS2-2026-3279

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 cups 2.4.17-1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 12 repositories · most starred shown

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 8

References