CVE-2013-10077 | OctoPrint 1.0.0 API Key settings.py getSettings information disclosure

October 24, 2026 Yanac

A vulnerability identified as problematic has been detected in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This manipulation causes information disclosure.

This vulnerability is tracked as CVE-2013-10077. The attack is possible to be carried out remotely. Moreover, an exploit is present.

You should upgrade the affected component.

Affected is a 2013 release where access control was not yet implemented and the endpoint was part of first-run setup). The API key has been admin-gated since 1.2.0 and GET /api/settings is protected by Permissions.SETTINGS_READ plus reauthentication in all current releases.VulDB Recent EntriesRead More