CVE-2026-34990

Description

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable Authorization: Local ... token. That token is enough to drive /admin/ requests on localhost, and the attacker can combine CUPS-Create-Local-Printer with printer-is-shared=true to persist a file:///... queue even though the normal FileDevice policy rejects such URIs. Printing to that queue gives an arbitrary root file overwrite; the PoC below uses that primitive to drop a sudoers fragment and demonstrate root command execution. At time of publication, there are no publicly available patches.

How to fix CVE-2026-34990

To remediate CVE-2026-34990, upgrade the affected package to a fixed version below.

• —upgrade to 2.4.18-r0 or later
• —no fix listed

Is CVE-2026-34990 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 2.4.18-r0
• from 0

CVSS scores

References (2)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2026-34990
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-34990