CVE-2013-10077
Deferred Deferred - Pending Action

Information Disclosure in OctoPrint via API Key Handler

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.1.0-rc1 will fix this issue. Patch name: eccc9d6fbde0c46cdd6e255fd5ce9a30077ba954. You should upgrade the affected component. Affected is a 2013 release where access control was not yet implemented and the endpoint was part of first-run setup). The API key has been admin-gated since 1.2.0 and GET /api/settings is protected by Permissions.SETTINGS_READ plus reauthentication in all current releases.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2013-10077
EUVD
EUVD-2013-7296

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a OctoPrint 1.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an information disclosure weakness in OctoPrint version 1.0.0. It exists in the getSettings function of the API Key Handler component. An attacker can remotely exploit this to access sensitive information due to improper access controls during the software's initial setup phase.

Detection Guidance

This vulnerability affects OctoPrint versions prior to 1.1.0-rc1. To detect it, check the OctoPrint version running on your system. If it is 1.0.0 or earlier, the system is vulnerable. No specific commands are provided in the context, but you can verify the version via the OctoPrint web interface or by inspecting the server logs for the affected file path src/octoprint/server/ajax/settings.py.

Impact Analysis

An attacker could remotely access sensitive settings or data exposed by the vulnerable endpoint. This could lead to unauthorized information disclosure, potentially including system configurations or user data. The exploit is publicly available, increasing the risk of real-world attacks.

Mitigation Strategies

Upgrade OctoPrint to version 1.1.0-rc1 or later to fix the vulnerability. The patch name is eccc9d6fbde0c46cdd6e255fd5ce9a30077ba954. If upgrading is not immediately possible, ensure that the affected endpoint is not exposed to untrusted networks and restrict access to the API key handler functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2013-10077. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart