Back Sploitus

Exploit for Improper Authentication in Openprinting Cups

Sploitus • September 28, 2026

A generic proof-of-concept for **CVE-2026-34990**, a local privilege escalation vulnerability affecting vulnerable versions of CUPS.

The exploit demonstrates how a local unprivileged user can abuse CUPS local authentication and printer configuration behavior to obtain an arbitrary file write as `root` and escalate privileges.

- **Impact:** Arbitrary file write as root

CVE-2026-34990 was originally reported by:

**Asim Viladi Oglu Manizada (@manizada)**

I am **not the discoverer of this vulnerability**.

This repository contains my adapted and tested proof-of-concept implementation based on publicly disclosed technical information.

Reuse token against privileged CUPS operations

The PoC uses the current local username automatically.

A successful exploit can then be verified with:

git clone

This PoC is intentionally written as a generic implementation of the publicly disclosed CVE.

Only use this code on systems you own or systems for which you have explicit authorization.

The author is not responsible for misuse of this software.

**PoC adaptation, testing, and documentation:**

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerability in CUPS Allows Local Privilege Escalation A vulnerability in CUPS (Common UNIX Printing System) version 2.4.16 allows local privilege escalation through improper authentication. Attackers can exploit this flaw by capturing the Local authorization token from the cupsd service, enabling them to execute commands as root. The attack involves setting up a rogue IPP server that challenges cupsd, which responds with its admin token. This token can then be reused to create a malicious print queue that writes to sensitive files, including sudoers configurations. The vulnerability is tracked as CVE-2026-34990, published on April 3, 2026, with the first public proof-of-concept released on August 6, 2026. CUPS versions 2.4.16 and earlier are affected, while version 2.4.17 and later are patched. Security professionals are advised to review their CUPS installations and apply updates promptly. 9 sources 71

Extracted Entities

Exploit for Improper Authentication in Openprinting Cups

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)