CVE-2014-125135
Deferred Deferred - Pending Action

Hard-Coded Secret Key in OctoPrint

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address this issue. The name of the patch is b4699825d6ab92d5451e5b1e3a06dfb81f86e777. The affected component should be upgraded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2014-125135
EUVD
EUVD-2014-9832

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
n/a OctoPrint 1.0.0
n/a OctoPrint 1.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.
CWE-320 Key Management Errors

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a hard-coded cryptographic key in OctoPrint versions 1.0.0 and 1.1.0 due to a flaw in the Flask Secret Key Handler component. Attackers can remotely manipulate the system to exploit this hard-coded key, potentially compromising session security and enabling unauthorized access.

Detection Guidance

Check if your OctoPrint instance uses a hard-coded secret key by inspecting the configuration file for a fixed 'secretKey' value. Look for the presence of a hard-coded key in settings.py or similar configuration files.

Impact Analysis

The vulnerability allows remote attackers to bypass security measures, gain unauthorized access to sessions, and potentially execute malicious actions on the OctoPrint server. This could lead to data breaches, unauthorized printer control, or other security incidents.

Compliance Impact

This vulnerability involves the use of a hard-coded cryptographic key in OctoPrint, which could lead to unauthorized access or session hijacking. For compliance with GDPR or HIPAA, such vulnerabilities may result in data breaches, compromising personal or sensitive health information. Organizations using affected versions must address this issue to maintain compliance with data protection requirements.

Mitigation Strategies

Upgrade OctoPrint to version 1.11.1 or later to ensure a unique secret key is generated automatically. Verify the update by checking the configuration file for a randomly generated 'secretKey' field.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2014-125135. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart