CVE-2026-105326

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-105326", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-10-05T08:47:01.523Z", "datePublished": "2026-10-05T18:58:56.161Z", "dateUpdated": "2026-11-06T17:45:23.850Z"}, "containers": {"cna": {"title": "Cups: cups: argument injection in mailto notifier via notify-recipient-uri", "metrics": [{"other": {"content": {"value": "Low", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with \"-\" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Hardened Images", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "cups-main", "defaultStatus": "affected", "versions": [{"version": "2.4.19-4.3.hum1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:hummingbird:1"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cups", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:10"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cups", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:8"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cups", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:9"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhel9/cups", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:9"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:77638", "name": "RHSA-2026:77638", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-105326", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545835", "name": "RHBZ#2545835", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/OpenPrinting/cups/commit/1244ed9"}, {"url": "https://github.com/OpenPrinting/cups/commit/611d1bd"}, {"url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-r4wf-366f-f6g3"}], "datePublic": "2026-10-05T08:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-88", "description": "Improper Neutralization of Argument Delimiters in a Command", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-88: Improper Neutralization of Argument Delimiters in a Command", "workarounds": [{"lang": "en", "value": "Restrict network access to the CUPS service (port 631/tcp) to trusted hosts only, and avoid exposing cupsd to untrusted networks. If email notifications are not required, do not configure mailto subscriptions or remove/disable the mailto notifier. Ensure only a trusted mail transfer agent is installed and referenced from CUPS mailto configuration. Monitor for unexpected printer subscriptions and unusual sendmail activity from the lp user."}], "timeline": [{"lang": "en", "time": "2026-09-13T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-05T08:00:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-06T17:45:23.850Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-06T14:43:04.210560Z", "id": "CVE-2026-105326", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T14:52:10.816Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-105326", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-06T14:43:04.210560Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T14:43:45.268Z"}}], "cna": {"title": "Cups: cups: argument injection in mailto notifier via notify-recipient-uri", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Low", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.5, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "versions": [{"status": "unaffected", "version": "2.4.19-4.3.hum1", "lessThan": "*", "versionType": "rpm"}], "packageName": "cups-main", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "cups", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "cups", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "cups", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "rhel9/cups", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-09-13T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-05T08:00:00.000Z", "value": "Made public."}], "datePublic": "2026-10-05T08:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:77638", "name": "RHSA-2026:77638", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-105326", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545835", "name": "RHBZ#2545835", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/OpenPrinting/cups/commit/1244ed9"}, {"url": "https://github.com/OpenPrinting/cups/commit/611d1bd"}, {"url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-r4wf-366f-f6g3"}], "workarounds": [{"lang": "en", "value": "Restrict network access to the CUPS service (port 631/tcp) to trusted hosts only, and avoid exposing cupsd to untrusted networks. If email notifications are not required, do not configure mailto subscriptions or remove/disable the mailto notifier. Ensure only a trusted mail transfer agent is installed and referenced from CUPS mailto configuration. Monitor for unexpected printer subscriptions and unusual sendmail activity from the lp user."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with \"-\" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-88", "description": "Improper Neutralization of Argument Delimiters in a Command"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-06T17:45:23.850Z"}, "x_redhatCweChain": "CWE-88: Improper Neutralization of Argument Delimiters in a Command"}}, "cveMetadata": {"cveId": "CVE-2026-105326", "state": "PUBLISHED", "dateUpdated": "2026-11-06T17:45:23.850Z", "dateReserved": "2026-10-05T08:47:01.523Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-10-05T18:58:56.161Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "cups-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "2.4.19-4.3.hum1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:10"], "defaultStatus": "affected", "packageName": "cups", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "cups", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "cups", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "rhel9/cups", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with \"-\" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user."}], "id": "CVE-2026-105326", "lastModified": "2026-11-06T18:17:39.750", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 1.4, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-105326", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-06T14:43:04.210560Z", "version": "2.0.3"}}]}, "published": "2026-10-05T19:17:16.393", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:77638"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-105326"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545835"}, {"source": "secalert@redhat.com", "url": "https://github.com/OpenPrinting/cups/commit/1244ed9"}, {"source": "secalert@redhat.com", "url": "https://github.com/OpenPrinting/cups/commit/611d1bd"}, {"source": "secalert@redhat.com", "url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-r4wf-366f-f6g3"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-88"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "cups: cups: argument injection in mailto notifier via notify-recipient-uri", "id": "2545835", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545835"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-88", "details": ["An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with \"-\" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user."], "mitigation": {"lang": "en:us", "value": "Restrict network access to the CUPS service (port 631/tcp) to trusted hosts only, and avoid exposing cupsd to untrusted networks. If email notifications are not required, do not configure mailto subscriptions or remove/disable the mailto notifier. Ensure only a trusted mail transfer agent is installed and referenced from CUPS mailto configuration. Monitor for unexpected printer subscriptions and unusual sendmail activity from the lp user."}, "name": "CVE-2026-105326", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "cups", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "cups", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "cups", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "rhel9/cups", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "cups", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-05T08:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-105326\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105326\nhttps://github.com/OpenPrinting/cups/commit/1244ed9\nhttps://github.com/OpenPrinting/cups/commit/611d1bd\nhttps://github.com/OpenPrinting/cups/security/advisories/GHSA-r4wf-366f-f6g3"], "statement": "This vulnerability is rated Low because exploitation requires multiple environmental conditions beyond the CUPS code flaw alone. The vulnerable mailto notifier logic is present in CUPS packages shipped in Red Hat Enterprise Linux, but practical impact on RHEL is limited: RHEL typically provides Postfix's sendmail-compatible wrapper, which does not support the traditional sendmail -C configuration option used in public proof-of-concept chains, and many systems do not install or enable an MTA for CUPS notifications. By default, cupsd listens only on the local loopback interface unless administrators explicitly configure remote access. Create-Printer-Subscription is allowed for unauthenticated clients only under the default policy when cupsd is configured to accept remote IPP; operators can reduce exposure by restricting network access to the printing service and disabling mail notifications if unused. Red Hat is tracking upstream fixes and will publish updated CUPS packages when available.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "cups", "vendor": "cups"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Red Hat Enterprise Linux 10", "source": "cna", "vendor": "Red Hat"}, "product": "enterprise_linux", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "Red Hat Hardened Images", "source": "cna", "vendor": "Red Hat"}, "product": "hardened_images", "vendor": "redhat"}], "created": "2026-10-05T21:00:21.726606+00:00", "updated": "2026-10-09T08:45:23.646983+00:00", "vendors": ["cups", "cups$PRODUCT$cups", "redhat", "redhat$PRODUCT$enterprise_linux", "redhat$PRODUCT$hardened_images"]}