Is CVE-2026-123364 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123364 being exploited in the wild.

How severe is CVE-2026-123364?

Medium severity, with a CVSS score of 4, published 9 November 2026.

Which products and versions are affected?

OctoPrint 2.0.0rc1 to 2.0.0rc6; OctoPrint (PyPI) >= 2.0.0rc1, <= 2.0.0rc6, ECOSYSTEM:introduced=2.0.0rc1,fixed=2.0.0rc7.

Is there a fix for CVE-2026-123364?

Yes. OctoPrint (PyPI): upgrade to 2.0.0rc7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123364 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-123364?

Check whether you run OctoPrint or OctoPrint (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123364: OctoPrint stored XSS in connection parameters

Q: Is there a fix for CVE-2026-123364?

Yes. OctoPrint (PyPI): upgrade to 2.0.0rc7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-123364 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-123364?

Check whether you run OctoPrint or OctoPrint (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123364 · Severity: medium · CVSS 4 · Published 2026-11-09

OctoPrint is a web interface that controls consumer 3D printers. In versions 2.0.0rc1 through 2.0.0rc6, an authenticated user can inject malicious code into saved printer connection settings (port or baud rate), which executes in the browser of any other user viewing those settings, potentially allowing the attacker to perform any action the victim can perform in OctoPrint.

Technologies: OctoPrint, OctoPrint (PyPI). Vendors: OctoPrint, PyPI.

Quick answers

Is CVE-2026-123364 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123364 being exploited in the wild.
How severe is CVE-2026-123364?: Medium severity, with a CVSS score of 4, published 9 November 2026.
Which products and versions are affected?: OctoPrint 2.0.0rc1 to 2.0.0rc6; OctoPrint (PyPI) >= 2.0.0rc1, <= 2.0.0rc6, ECOSYSTEM:introduced=2.0.0rc1,fixed=2.0.0rc7.
Is there a fix for CVE-2026-123364?: Yes. OctoPrint (PyPI): upgrade to 2.0.0rc7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123364 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-123364?: Check whether you run OctoPrint or OctoPrint (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

OctoPrint (PyPI): upgrade to 2.0.0rc7 or later
```
pip install "OctoPrint>=2.0.0rc7"
```

Technical details

This is a stored cross-site scripting (XSS) vulnerability in the Serial Connector plugin. An authenticated attacker supplies a crafted port or baudrate value through the API connect request, which OctoPrint persists in printerConnection.preferred.parameters and renders unescaped as HTML in the template printerconnection.jinja2. The fix changes the Knockout.js binding from "html" to "text" to escape HTML entities before rendering.

Affected products

OctoPrint OctoPrint 2.0.0rc1 to 2.0.0rc6

Identifiers

CVE-2026-123364
GHSA-p623-mxf7-qxjm

Timeline

2026-11-09: disclosed
2026-10-20: patched: Fixed in 2.0.0rc7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.