high
advisory
OctoPrint: Hard-coded cryptographic key in Flask Secret Key Handler (CVE-2014-125135)
A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0 involving a hard-coded cryptographic key in the Flask Secret Key Handler.
CVE search metadata
CVE search record: CVE-2014-125135. Severity: high. CVSS: 7.3. KEV: no. Product: OctoPrint 1.0.0, OctoPrint 1.1.0. Brief: OctoPrint: Hard-coded cryptographic key in Flask Secret Key Handler (CVE-2014-125135). Brief link: https://feed.craftedsignal.io/briefs/2026-10-octoprint-secret-key/
Triage facts
Revision 1- Applicability
- OctoPrint 1.0.0, OctoPrint 1.1.0
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 26, 21:46 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability exists in the Flask Secret Key Handler component of OctoPrint versions 1.0.0 and 1.1.0. The implementation uses a hard-coded cryptographic key. The attack may be performed from remote.
Recommendation
Upgrading to version 1.11.1 is able to address this issue.