Cups: cups: argument injection in mailto notifier via notify-recipient-uri
Summary
| CVE | CVE-2026-105326 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-05 19:17:16 UTC |
| Updated | 2026-10-07 18:17:15 UTC |
| Description | An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with "-" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user. |
Risk And Classification
Primary CVSS: v3.1 2.5 LOW from [email protected]
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.002160000 probability, percentile 0.109940000 (date 2026-10-07)
Problem Types: CWE-88 | CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 2.5 | LOW | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
| 3.1 | CNA | CVSS | 2.5 | LOW | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Hardened Images | unaffected 2.4.19-4.3.hum1 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 10 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:77638 | [email protected] | access.redhat.com | |
| github.com/OpenPrinting/cups/security/advisories/GHSA-r4wf-366f-f6g3 | [email protected] | github.com | |
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | |
| github.com/OpenPrinting/cups/commit/1244ed9 | [email protected] | github.com | |
| github.com/OpenPrinting/cups/commit/611d1bd | [email protected] | github.com | |
| access.redhat.com/security/cve/CVE-2026-105326 | [email protected] | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-09-13T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2026-10-05T08:00:00.000Z | Made public. |
Workarounds
CNA: Restrict network access to the CUPS service (port 631/tcp) to trusted hosts only, and avoid exposing cupsd to untrusted networks. If email notifications are not required, do not configure mailto subscriptions or remove/disable the mailto notifier. Ensure only a trusted mail transfer agent is installed and referenced from CUPS mailto configuration. Monitor for unexpected printer subscriptions and unusual sendmail activity from the lp user.