CVE-2024-51493 - CVE House
Back to Database
Status published Medium CVE-2024-51493

API key access in settings without reauthentication in OctoPrint

Vulnerability Description

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain a vulnerability that allows an attacker that has gained temporary control over an authenticated victim's OctoPrint browser session to retrieve/recreate/delete the user's or - if the victim has admin permissions - the global API key without having to reauthenticate by re-entering the user account's password. An attacker could use a stolen API key to access OctoPrint through its API, or disrupt workflows depending on the API key they deleted. This vulnerability will be patched in version 1.10.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-51493

Credits & Attribution

No credits recorded in the NVD database.

References

More from OctoPrint

View All →
CVE-2025-64187
OctoPrint is vulnerable to XSS through Action Command Notifications and Prompts
Medium 4.6
CVE-2025-58180
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
High 7.5
CVE-2025-48879
OctoPrint Vulnerable to Denial of Service through malformed HTTP request
Medium 6.5
CVE-2025-48067
OctoPrint vulnerable to possible file extraction via upload endpoints
Medium 5.4
CVE-2025-32788
OctoPrint Authenticated Reverse Proxy Page Authentication Bypass
Medium 4.3

Affected Vendor

Affected Software

OctoPrint
Vulnerable Versions:
< 1.10.3

Timeline

Official Publish: November 5th, 2024
Last Modified: November 5th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-620

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.