OctoPrint does not have rate limiting on the login page

HIGH 7.5CVE-2022-2822 · GHSA-5w5x-q9p5-9qg3 · PYSEC-2026-887 · Published 15/08/2022 · updated 17/06/2026

In short

CVE-2022-2822 is a HIGH (CVSS 7.5) vulnerability affecting octoprint, octoprint (octoprint).
Chance of exploitation in the next 30 days (EPSS): 0.87%, higher than 58.7% of all vulnerabilities.
Fix: update to 1.9.0 or later.

Package	Affected versions	Patched versions
octoprint PyPI	`≤ 1.7.3`	No fix yet
octoprint octoprint	`< 1.9.0`	`1.9.0`

Description

OctoPrint 1.7.3 and prior does not have rate limiting on the login page, making it possible for attackers to attempt brute force attacks. The severity of this issue is limited by OctoPrint normally running in a restricted LAN. The devel and maintenance branches of the repository have a fix that limits the rate of failed login attempts.

NVD description

An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts.

References

nvd.nist.gov/vuln/detail/CVE-2022-2822 · ADVISORY
octoprint/octoprint commit 82c892b · WEB
octoprint/octoprint · PACKAGE
huntr.dev/bounties/6369f355-e6ef-4469-af75-0f6ff00cde3d · WEB
pypi.org/project/octoprint · PACKAGE
GitHub Advisory GHSA-5w5x-q9p5-9qg3 · ADVISORY

More vulnerabilities in octoprint

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

octoprint

PyPI

≤ 1.7.3

No fix yet

octoprint

< 1.9.0

1.9.0

Description

NVD description

An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts.

More vulnerabilities in octoprint

See all →