# CVE-2013-10077: OctoPrint API key information disclosure in settings endpoint

Source: https://junglewise.ai/threats/cve-2013-10077-a-weakness-has-been-identified-in-octoprint-1-0-0-this-impacts  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2013-10077 · Severity: medium · CVSS 5.3 · Published 2026-10-26

OctoPrint is a web interface for managing 3D printers. In version 1.0.0, the settings API endpoint was accessible without authentication, allowing remote attackers to retrieve sensitive information including the admin API key. This could enable unauthorized control of the 3D printer or access to its configuration data.

Technologies: [OctoPrint](https://junglewise.ai/threats/technologies/octoprint-octoprint). Vendors: [OctoPrint](https://junglewise.ai/threats/vendors/octoprint).

## Quick answers

**Is CVE-2013-10077 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2013-10077 being exploited in the wild.

**How severe is CVE-2013-10077?** Medium severity, with a CVSS score of 5.3, published 26 October 2026.

**Which products and versions are affected?** OctoPrint 1.0.0.

**Is there a fix for CVE-2013-10077?** Yes: fixed in 1.1.0-rc1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2013-10077 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2013-10077?** Check whether you run OctoPrint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.1.0-rc1

## Technical details

The getSettings function in src/octoprint/server/ajax/settings.py lacked access control in OctoPrint 1.0.0, exposing the API key and other sensitive settings via an unauthenticated remote endpoint. The vulnerability was part of the first-run setup and has been protected by authentication and permissions checks (Permissions.SETTINGS_READ plus reauthentication) since version 1.2.0.

## Affected products

- OctoPrint OctoPrint 1.0.0

## Timeline

- 2013-12-21: disclosed: Patch commit eccc9d6fbde0c46cdd6e255fd5ce9a30077ba954
- 2026-10-26: other: Advisory published

## References

- [https://github.com/OctoPrint/OctoPrint/](https://github.com/OctoPrint/OctoPrint/)
- [https://github.com/OctoPrint/OctoPrint/commit/eccc9d6fbde0c46cdd6e255fd5ce9a30077ba954](https://github.com/OctoPrint/OctoPrint/commit/eccc9d6fbde0c46cdd6e255fd5ce9a30077ba954)

## Related threats

- [OctoPrint stored XSS in connection parameters](https://junglewise.ai/threats/cve-2026-123364-octoprint-provides-a-web-interface-for-controlling-consumer-3d)
- [OctoPrint hard-coded cryptographic key in Flask secret key handler](https://junglewise.ai/threats/cve-2014-125135-a-security-vulnerability-has-been-detected-in-octoprint-1-0-0-1)
- [OctoPrint command injection in Command API](https://junglewise.ai/threats/cve-2026-94490-a-security-flaw-has-been-discovered-in-octoprint-1-0-0-affected)
- [OctoPrint path traversal in File Download API](https://junglewise.ai/threats/cve-2026-94489-a-vulnerability-was-identified-in-octoprint-1-0-0-affected-by)