OctoPrint employs a character‑by‑character comparison for API key validation that short‑circuits on the first mismatch. This allows an attacker who can measure response times on denied requests to infer each character of the key, effectively extracting the key over the network. Although no public proof of concept exists, the vulnerability can be exploited if network latency and noise conditions are favorable, exposing credentials that grant unrestricted control over attached printers.

All OctoPrint releases up to and including version 1.11.5 are affected. The issue was fixed in OctoPrint 1.11.6 and later. Administrators should verify that their deployment uses a patched version.

The CVSS score of 6 indicates moderate impact, while the EPSS score of less than 1 % reflects a very low estimated exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. An attacker requires network access to the OctoPrint instance, typically over a local network or public‑internet exposure, to perform the timing analysis. With sufficient network isolation and low latency, the attack becomes impractical, but the risk is higher for publicly exposed deployments.