CVE-2026-34990: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-34990 is a local privilege escalation vulnerability in OpenPrinting CUPS affecting versions 2.4.16 and prior, titled "Local print admin token disclosure using temporary printers." A local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service, capturing a reusable Authorization: Local token that grants access to /admin/ endpoints. By chaining this token with the CUPS-Create-Local-Printer operation and printer-is-shared=true, the attacker can bypass the FileDevice policy and persist a file:/// print queue, ultimately achieving arbitrary root file overwrite and root command execution. The vulnerability was published on April 3, 2026, and patched in CUPS 2.4.17. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper authentication (CWE-287) combined with external control of file name or path (CWE-73). The CUPS-Create-Local-Printer operation is not restricted to admin-authenticated users under the default policy, allowing any local user to create a temporary printer with an arbitrary device-uri, including file:/// paths. When cupsd validates the printer URI by connecting to the attacker-controlled IPP endpoint, it presents a reusable Authorization: Local token (sourced from certs/0), which the attacker captures. This token is then used to drive /admin/ requests: the attacker sets printer-is-shared=true to promote the temporary queue to permanent without re-supplying the device-uri, bypassing the FileDevice policy check that only applies to the normal admin add/modify path. Printing to the persisted file:/// queue causes cupsd (running as root) to open the target file with O_WRONLY|O_CREAT|O_TRUNC, enabling arbitrary overwrite of any file on the system. A complete, runnable Python PoC exploit is included in the GitHub Security Advisory (GitHub Advisory).

Successful exploitation grants a local unprivileged user full root-level code execution on the affected system. The attacker can overwrite any file accessible to the root-owned cupsd process — the published PoC demonstrates dropping a sudoers fragment at /etc/sudoers.d/ to grant passwordless sudo access. This results in complete compromise of confidentiality, integrity, and availability of the host. When chained with a companion vulnerability (GHSA-4852-v58g-6cwf) targeting network-exposed CUPS deployments, the attack chain can be triggered by an unauthenticated remote attacker, significantly expanding the threat scope (GitHub Advisory, Feedly).

A complete, functional Python proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating reliable root command execution (GitHub Advisory). Exploitation has been reported by multiple security news outlets, and the vulnerability has been detected by Nessus (plugin IDs 307661, 310230, 311214, 311327, 317701, 319997) and Qualys (288565, 917886). The EPSS score is approximately 0.013% (low automated exploitation probability at time of scoring), and the vulnerability is not currently listed in the CISA KEV catalog. The exploit requires a race condition to persist the printer queue, but the PoC reliably succeeds within a small number of attempts (Feedly, CyberSecurityNews).

1. Reconnaissance: Confirm the target Linux system is running OpenPrinting CUPS version 2.4.16 or earlier with cupsd listening on localhost:631. Verify the attacker has a local unprivileged user account and can bind an unprivileged port on localhost.
2. Set up capture server: As the attacker, start a rogue IPP server (e.g., using the PoC's CaptureServer class) listening on a local unprivileged port (e.g., 127.0.0.1:9189) that responds to IPP connections with an HTTP 401 challenge advertising WWW-Authenticate: Local trc="y".
3. Trigger token capture: As the unprivileged user, invoke CUPS-Create-Local-Printer (via ipptool or direct IPP request) with device-uri=ipp://127.0.0.1:9189/ipp/print. CUPS validates the URI by connecting to the attacker's server and presents the Authorization: Local <token> header, which the capture server records.
4. Verify token: Confirm the captured token grants access to /admin/ endpoints by sending a test IPP request with Authorization: Local <token> to localhost:631/admin/.
5. Create malicious printer: Send a CUPS-Create-Local-Printer IPP request (no auth required) with device-uri=file:///etc/sudoers.d/unpriv-pwn to create a temporary printer queue pointing to the target file.
6. Persist the queue (race): Using the captured token, rapidly send CUPS-Add-Modify-Printer with printer-is-shared=true and ppd-name=raw, followed by CUPS-Accept-Jobs and Resume-Printer, to promote the temporary queue to permanent before the background validation thread can invalidate it. Retry up to ~80 times with short delays.
7. Print payload: Send a Print-Job IPP request to the persisted printer with the malicious payload (e.g., a sudoers line granting NOPASSWD: ALL) as the document body. CUPS opens the file:/// destination as root and writes the attacker-controlled bytes.
8. Execute as root: Run sudo -n /bin/sh -c id as the unprivileged user to confirm root command execution via the newly written sudoers fragment (GitHub Advisory).

• Network: Unexpected inbound IPP connections from cupsd to unprivileged localhost ports (e.g., ports >1024 on 127.0.0.1); repeated IPP CUPS-Create-Local-Printer requests from non-root local users to localhost:631.
• Logs: CUPS error log (/var/log/cups/error_log) entries showing printer creation with file:/// device URIs; repeated CUPS-Add-Modify-Printer and CUPS-Accept-Jobs operations in rapid succession from an unprivileged user; IPP authentication attempts to localhost ports not associated with known printers.
• File System: Unexpected new files in /etc/sudoers.d/ owned by root but containing entries for unprivileged users; new or modified files in sensitive system directories (e.g., /etc/, /etc/cron.d/) with recent timestamps matching CUPS job activity; new printer configuration entries in /etc/cups/printers.conf with file:/// device URIs.
• Process: cupsd spawning unexpected child processes or opening file descriptors to sensitive system paths; ipptool executed by unprivileged users with unusual -d device=ipp://127.0.0.1:<port>/ arguments.
• Sudo/Auth: Unprivileged users successfully executing sudo commands without a password on systems where this was not previously configured (GitHub Advisory, Red Hat Bugzilla).

Upgrade OpenPrinting CUPS to version 2.4.17 or later, which disables local certificate authentication over the loopback interface and drops support for writing to plain files via file:/// URIs (OpenPrinting Release). Distribution-specific patches are available for Ubuntu (USN-8405-1), SUSE (SUSE-SU-202621787-1), Amazon Linux 2 (ALAS2-2026-3279), Amazon Linux 2023 (ALAS2023-2026-1635), Slackware, and Fedora. As interim workarounds: restrict local access to the CUPS socket (/run/cups/cups.sock) to trusted users only; enforce strict FileDevice No in cupsd.conf (already default, but verify); and monitor for unexpected printer creation by unprivileged users. Disabling or restricting the CUPS-Create-Local-Printer operation via policy is also advisable where local printer creation is not required (GitHub Advisory, Red Hat Bugzilla).

The vulnerability attracted significant media and community attention, with coverage from The Register noting that the vulnerability was discovered by an AI agent pipeline (The Register), which was highlighted as a notable development in AI-assisted security research. The researcher credited with discovery, Asim Viladi Oglu Manizada (@manizada), disclosed that a custom AI agent pipeline was used to find the vulnerabilities, with manual validation performed afterward. The Canadian Centre for Cyber Security issued a security advisory (AV26-326), and the vulnerability was discussed on Reddit's r/netsec under the title "Spooler Alert: Remote Unauth'd RCE-to-Root Chain in CUPS" (Reddit). Security outlets including GBHackers, CyberPress, LinuxSecurity, and CyberSecurityNews published detailed write-ups, and the vulnerability was included in The Hacker News weekly recap (CyberSecurityNews).