CVE-2026-105326
Received Received - Intake

Argument Injection in CUPS Email Notification

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: redhat-SADP

Description
An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with "-" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-105326
EUVD
EUVD-2026-92637

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apple cups *
openprinting cups to 2.4.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-105326 is an argument injection flaw in CUPS (Common UNIX Printing System). When email notifications are enabled, the CUPS scheduler accepts printer subscription requests with a mailto notify-recipient-uri. The mailto notifier passes the recipient address directly to the sendmail program without proper sanitization. An attacker can craft a recipient address starting with a hyphen to inject command-line options, potentially executing arbitrary commands with the privileges of the CUPS service user.

Detection Guidance

To detect this vulnerability, check if CUPS is running and listening on the network. Use commands like 'ss -tulnp | grep cupsd' or 'netstat -tulnp | grep cupsd' to verify if CUPS is exposed on port 631/tcp. Inspect printer subscriptions with 'lpstat -s' or 'lpstat -a' for unexpected subscriptions. Monitor sendmail activity for unusual command-line arguments starting with hyphens.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary commands on your system with the privileges of the CUPS service user (typically 'lp'). Successful exploitation requires CUPS to be network-reachable, a traditional sendmail implementation, and specific conditions like disabled mail notifications or default CUPS policies. The impact depends on the mail transfer agent and system configuration.

Compliance Impact

This vulnerability may impact compliance by allowing unauthorized code execution on systems handling sensitive data. GDPR requires protecting personal data, and HIPAA mandates securing systems processing health information. Exploitation could lead to data breaches or unauthorized access, violating these regulations. Mitigation involves applying patches, restricting CUPS network access, and disabling unused features.

Mitigation Strategies

Immediately restrict network access to CUPS by binding it to localhost only or blocking external access to port 631/tcp. Disable mail notifications in CUPS if unused by editing cupsd.conf and setting 'NotifyEvents' to none. Update CUPS to the latest patched version. Monitor for unexpected printer subscriptions or unusual sendmail activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105326. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart