CVE-2024-32977

CRITICAL

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to complete...

Affects 1 product across 1 vendor.

CVSS 3.19.4
EPSS0.9%
Percentile59th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact.
CWE Weakness Definitions
CWE-290: CWE-290
Related Attack Patterns (CAPEC)
CAPEC-59 Session Credential Falsification through Prediction
via CWE-290
CAPEC-60 Reusing Session IDs (aka Session Replay)
via CWE-290
CAPEC-459 Creating a Rogue Certification Authority Certificate
via CWE-290
CAPEC-476 Signature Spoofing by Misrepresentation
via CWE-290
CAPEC-667 Bluetooth Impersonation AttackS (BIAS)
via CWE-290
Show all 10

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

CVE-2024-32977 affects OctoPrint versions up to 1.10.0, allowing unauthenticated attackers to bypass authentication if the `autologinLocal` option is enabled, by spoofing their IP address.

BSID: BS-2024-GLOBAL-192560-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2024-32977?
CVE-2024-32977 affects OctoPrint versions up to 1.10.0, allowing unauthenticated attackers to bypass authentication if the `autologinLocal` option is enabled, by spoofing their IP address.
What is the CVSS score for CVE-2024-32977?
CVE-2024-32977 has CVSS 9.4 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS: 0.9%.
Is CVE-2024-32977 actively exploited?
No confirmed active exploitation of CVE-2024-32977 as of 2026-09-25.
How do I remediate CVE-2024-32977?
Priority: IMMEDIATE. PSIRT: [email protected]
What systems are affected by CVE-2024-32977?
CVE-2024-32977 affects Octoprint Octoprint.
Vulnerability Details
CVE IDCVE-2024-32977
BSIDBS-2024-GLOBAL-192560-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Published2024-05-14
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
CWE-290
SourceNVD
Official Description

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the `autologinLocal` option is enabled within `config.yaml`, even if they come from networks that are not configured as `localNetworks`, spoofing their IP via the `X-Forwarded-For` header. If autologin is not enabled, this vulnerability does not have any impact. The vulnerability has been patched in version 1.10.1. Until the patch has been applied, OctoPrint administrators who have autologin enabled on their instances should disable it and/or to make the instance inaccessible from potentially hostile networks like the internet.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by sending requests to the OctoPrint web interface with a spoofed `X-Forwarded-For` header, tricking the system into thinking the request is coming from a local network, thus bypassing authentication.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Octoprint Octoprint < 1.10.1
Remediation

No official vendor advisory link on record. See the CVE record →

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 884 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashcac39b1fc779a8c932d64dd2c2191b1b1067067d6721653f0e7c1f32ba674164530c99ee92a5e4a37489cf5e48ab99a651862f4abb1706f415cf29ca04daefb3
Related CVEs affecting Octoprint
CVE-2018-16710 9.1 OctoPrint through 1.3.9 allows remote attackers to obtain sensitive informati... CVE-2022-3068 8.8 Improper Privilege Management in GitHub repository octoprint/octoprint prior ... CVE-2025-58180 8.8 OctoPrint provides a web interface for controlling consumer 3D printers. Octo... CVE-2025-62169 8.1 OctoPrint-SpoolManager is a plugin for managing spools and all their usage me... CVE-2022-2930 7.8 Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.
View all Octoprint CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.4 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →