Low [CVE-2026-105326] Cups: cups: argument injection in mailto notifier via notify-recipient-uri
This low-severity Red Hat Linux advisory covers CVE-2026-105326 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri.
The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with "-" to influence sendmail behavior.
Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user. This vulnerability is rated Low because exploitation requires multiple environmental conditions beyond the CUPS code flaw alone.
The vulnerable mailto notifier logic is present in CUPS packages shipped in Red Hat Enterprise Linux, but practical impact on RHEL is limited: RHEL typically provides Postfix's sendmail-compatible wrapper, which does not support the traditional sendmail -C configuration option used in public proof-of-concept chains, and many systems do not install or enable an MTA for CUPS notifications.
By default, cupsd listens only on the local loopback interface unless administrators explicitly configure remote access.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 7 hours ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 7 hours ago·verify at source
Mitigation checklist
- Restrict network access to the CUPS service (port 631/tcp) to trusted hosts only, and avoid exposing cupsd to untrusted networks. If email notifications are not required, do not configure mailto subscriptions or remove/disable the mailto notifier. Ensure only a trusted mail transfer agent is installed and referenced from CUPS mailto configuration. Monitor for unexpected printer subscriptions and unusual sendmail activity from the lp user.
Official advisory · high-confidence parse· fetched 7 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.