Back Sploitus Exploit for Improper Authentication in Openprinting Cups
# CVE-2026-34990 — CUPS Local unprivileged user → **root**, via a leaked CUPS `Local` authorization token and a policy-bypassing `file:///` print queue.
* [Affected Versions](#affected-versions)
* [How It Works Internally](#how-it-works-internally)
**CVE-2026-34990** is a local privilege escalation flaw in **OpenPrinting CUPS** affecting versions **2.4.16 and earlier**.
A local unprivileged user who can reach the CUPS daemon (`cupsd`) can potentially cause it to authenticate against an attacker-controlled IPP service on the loopback interface.
The resulting `Authorization: Local ` credential can then be reused against the CUPS administrative interface.
The attack chain can ultimately be used to create a `file:///` print queue and cause `cupsd` to write an attacker-controlled file with root privileges.
The canonical demonstration uses a `sudoers` drop-in to obtain a root shell.
This repository contains a **single-file Python 3 PoC** implementing the attack chain, including a safer `--check` mode for demonstrating the vulnerable file-write behavior without directly creating a persistent privilege-escalation configuration.
| Field | Value |
| ----------------------- | --------------------------- |
| **CVE ID** | CVE-2026-34990 |
| **Component** | OpenPrinting CUPS (`cupsd`) |
| **Affected Versions** | ` **Note:** Verify the current upstream advisory before relying on the affected-version range in production research, as vendor patches and version status may change.
[1] Local user issues CUPS-Create-Local-Printer
| device-uri = ipp://127.0.0.1:9189/ipp/print
[2] cupsd connects to the attacker-controlled
[4] CUPS/libcups retries the request with:
[6] Token reused against the CUPS administrative interface
[7] Temporary file:// printer is created and
transitioned through the printer-management workflow
[8] Print-Job causes cupsd to write the supplied
[9] Demonstration payload can modify a privileged
* Local shell access as an unprivileged user
* Reachable CUPS service on `127.0.0.1:631`
* `sudo` available for the privilege-escalation demonstration
* A Linux system running a vulnerable CUPS version
No external Python packages are required.
git clone
Start with the non-persistent verification mode:
The check mode attempts to demonstrate the vulnerable root-owned file-write primitive using a temporary proof file and cleans up after the test.
The default mode demonstrates the complete privilege-escalation chain:
| Flag | Default | Description |
| ----------------- | ---------: | ------------------------------------------------ |
| `--cups-port` | `631` | Local CUPS TCP port |
| `--listen-port` | `9189` | Loopback port used by the token-capture listener |
| `--check` | Off | Safe verification mode |
| `-c`, `--command` | — | Execute a command after successful exploitation |
| `--proof-dir` | `/var/tmp` | Parent directory for temporary proof files |
| `--attempts` | `8` | Number of file-write attempts |
| `--iterations` | `80` | Number of IPP request rounds per attempt |
██████╗ ██╗ ██╗ ██████╗██╗ ██╗██████╗ ███████╗██████╗ ███████╗ ██████╗ ██╗ ██████╗ ██╗███████╗██████╗
██╔═████╗╚██╗██╔╝██╔════╝╚██╗ ██╔╝██╔══██╗██╔════╝██╔══██╗██╔════╝██╔═══██╗██║ ██╔══██╗██║██╔════╝██╔══██╗
██║██╔██║ ╚███╔╝ ██║ ╚████╔╝ ██████╔╝███████╗██████╔╝█████╗ ██║ ██║██║ ██║ ██║██║█████╗ ██████╔╝
████╔╝██║ ██╔██╗ ██║ ╚██╔╝ ██╔══██╗╚════██║██╔══██╗██╔══╝ ██║ ██║██║ ██║ ██║██║██╔══╝ ██╔══██╗
╚██████╔╝██╔╝ ██╗╚██████╗ ██║ ██████╔╝███████║██║ ██║███████╗╚██████╔╝███████╗██████╔╝██║███████╗██║ ██║
╚═════╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═════╝ ╚══════╝╚═╝ ╚═╝╚══════╝ ╚═════╝ ╚══════╝╚═════╝ ╚═╝╚══════╝╚═╝ ╚═╝
The captured token is reused in requests to the CUPS administrative interface.
This provides the authorization context required for subsequent printer-management operations.
The attack then abuses the printer-management workflow to create a queue referencing a `file://` target.
The PoC uses the printer-management operations necessary to bring the queue online and submit a print job.
The print job is submitted as a raw document.
Because `cupsd` is operating with root privileges, the resulting file operation can occur with root permissions.
The `--check` mode uses this primitive to create a temporary proof file and verify that it is owned by UID 0.
The full demonstration can use a privileged configuration file such as a `sudoers` drop-in.
If the file is successfully written with the appropriate ownership and permissions, the affected user can invoke:
| Symptom | Likely Cause | Suggested Fix |
| ------------------------- | ---------------------------------------------- | -------------------------------------- |
| `No Local token received` | CUPS is patched or the listener is unreachable | Verify the CUPS version and listener |
| `CUPS is not reachable` | CUPS is stopped or uses another port | Use `--cups-port ` |
| No inbound connection | Local printer creation is restricted | Review CUPS operation policy |
| `NOT CONFIRMED` | File-write attempt did not win | Increase `--attempts` / `--iterations` |
| Sudoers payload rejected | Username or environment differs | Use `--check` |
| Listener bind error | Port already in use | Use another `--listen-port` |
Defenders can monitor for several indicators associated with this attack chain.
particularly connections to unexpected local ports.
sudo tcpdump -i lo -n 'tcp and port 9189'
Pay particular attention to printer definitions containing:
for unexpected files created by or associated with `cupsd`.
A file-integrity monitoring solution can help detect these changes.
Investigate unexpected printers whose device URI begins with:
credentials across CUPS administrative requests.
Until an appropriate vendor fix is deployed:
Review the CUPS configuration and disable file-device support where it is not required.
Limit access to CUPS administrative functionality to trusted users and processes.
Do not expose CUPS administration unnecessarily.
Where supported by the deployment architecture, isolate CUPS using:
Apply the appropriate upstream/vendor security update when available.
Always verify the currently supported CUPS release and security advisory before deploying mitigations based on a historical version range.
This project is provided for **authorized security testing, vulnerability research, and educational purposes only**.
Use this PoC exclusively against systems that you own or have **explicit written authorization** to test.
Unauthorized access to computer systems may violate applicable laws.
The author assumes no responsibility for misuse, damage, data loss, or unauthorized activity resulting from the use of this software.
**CVE-2026-34990 — Local Privilege Escalation**
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
