CVE-2025-62169: OctoPrint-SpoolManager Auth Bypass Flaw

CVE-2025-62169 Overview

CVE-2025-62169 is an authentication and authorization bypass vulnerability in the OctoPrint-SpoolManager plugin, which manages filament spools and usage metadata for 3D printers. The plugin's API endpoints fail to enforce authentication or authorization checks, allowing unauthenticated network attackers to interact with spool management functionality. The flaw affects versions 1.8.0a2 and older on the testing branch and 1.7.7 and older on the stable branch. The issue is classified under [CWE-287] Improper Authentication. The impact is reduced when running OctoPrint 1.11.2 or newer, which enforces additional plugin-level protections.

Critical Impact

Unauthenticated attackers reachable over the network can invoke SpoolManager APIs to read, modify, or delete spool data, with high impact to confidentiality, integrity, and availability.

Affected Products

• OctoPrint-SpoolManager testing branch versions 1.8.0a2 and older
• OctoPrint-SpoolManager stable branch versions 1.7.7 and older
• OctoPrint deployments running plugin versions below the patched releases (impact reduced when OctoPrint core is 1.11.2 or newer)

Discovery Timeline

• 2025-10-23 - CVE-2025-62169 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-62169

Vulnerability Analysis

The OctoPrint-SpoolManager plugin exposes Flask blueprint routes used to manage spool metadata, QR code generation, and database operations. These routes did not gate access behind OctoPrint's permission system. The plugin overrode is_blueprint_protected to return False, which explicitly disabled the API key requirement that OctoPrint normally enforces on blueprint routes. Any network-reachable client could therefore reach SpoolManager endpoints without credentials.

Because SpoolManager endpoints read and write persistent plugin state, an attacker can tamper with spool records, exfiltrate stored metadata, or disrupt printer workflows that depend on accurate spool data. The CVSS vector reflects network reachability without privileges or user interaction, with high impact across all three security properties.

Root Cause

The root cause is an explicit opt-out from OctoPrint's blueprint protection mechanism. The plugin declared its API surface as unprotected, bypassing the framework's authentication layer rather than integrating with it. There was also no per-route enforcement of OctoPrint's Permissions access controls.

Attack Vector

Exploitation requires network access to the OctoPrint instance hosting the vulnerable SpoolManager plugin. An attacker sends HTTP requests directly to plugin API routes such as /plugin/SpoolManager/... without supplying an API key or session cookie. The server processes the request as if it were authorized.

# Patch removing the blanket bypass of OctoPrint blueprint protection
# Source: https://github.com/WildRikku/OctoPrint-SpoolManager/commit/b725e113316e177ce81238a2dbbbdb63d92c40b0

        else:
            abort(404)

-    # hmmm..TODO not fully tested
-    def is_blueprint_protected(self):
-        return False  # No API key required to request API access
-
     #####################################################################################################   GENERATE QR FOR SPOOL
     @octoprint.plugin.BlueprintPlugin.route("/generateQRCode/<string:databaseId>", methods=["GET"])
     def generateSpoolQRCode(self, databaseId):

The companion change imports OctoPrint's permission model so that routes can enforce proper access controls:

# Source: https://github.com/WildRikku/OctoPrint-SpoolManager/commit/b725e113316e177ce81238a2dbbbdb63d92c40b0

 import flask
 import octoprint.plugin
 from octoprint.events import Events
-
+from octoprint.access.permissions import Permissions
 from octoprint_SpoolManager.DatabaseManager import DatabaseManager

 from octoprint_SpoolManager.newodometer import NewFilamentOdometer

Detection Methods for CVE-2025-62169

Indicators of Compromise

• HTTP requests to /plugin/SpoolManager/ routes that lack an X-Api-Key header or a valid OctoPrint session cookie
• Unexpected modifications, deletions, or additions to SpoolManager database entries with no corresponding administrator activity
• Requests to /plugin/SpoolManager/generateQRCode/<databaseId> from external IP addresses or non-management networks

Detection Strategies

• Inspect OctoPrint and reverse proxy access logs for SpoolManager plugin endpoints accessed by clients that never authenticated
• Correlate plugin API activity with OctoPrint user session events to flag anonymous calls reaching plugin routes
• Run the installed plugin version against the patched baselines (1.7.8 stable, 1.8.0a3 testing) and alert on older builds

Monitoring Recommendations

• Forward OctoPrint logs to a centralized SIEM and create rules for unauthenticated /plugin/SpoolManager access
• Monitor changes to the SpoolManager database file or plugin data directory for write activity outside normal print workflows
• Track outbound exposure of OctoPrint instances on the network perimeter and alert when port 5000 or proxied OctoPrint URLs become reachable from untrusted networks

How to Mitigate CVE-2025-62169

Immediate Actions Required

• Upgrade OctoPrint-SpoolManager to 1.7.8 on the stable branch or 1.8.0a3 on the testing branch
• Upgrade the OctoPrint core to version 1.11.2 or newer to benefit from additional plugin protections that reduce impact
• Remove direct internet exposure of OctoPrint instances and place them behind authenticated reverse proxies or VPNs
• Review SpoolManager data for unauthorized modifications introduced before patching

Patch Information

The maintainers fixed the issue by removing the is_blueprint_protected override that returned False and by importing octoprint.access.permissions.Permissions to enforce proper authorization on plugin routes. Fixed releases are available at GitHub Release 1.7.8 and GitHub Release 1.8.0a3. Full technical details are documented in GitHub Security Advisory GHSA-2rrc-f24f-94f6.

Workarounds

• Disable the SpoolManager plugin until the host can be upgraded to a patched release
• Restrict access to the OctoPrint web interface using firewall rules or an authenticated reverse proxy that blocks unauthenticated requests to /plugin/SpoolManager/
• Limit OctoPrint exposure to trusted management networks only

# Example: restrict OctoPrint access to a trusted LAN using iptables
iptables -A INPUT -p tcp --dport 5000 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5000 -j DROP

# Example: upgrade the plugin from the OctoPrint host shell
~/oprint/bin/pip install --upgrade "https://github.com/WildRikku/OctoPrint-SpoolManager/archive/refs/tags/1.7.8.zip"
sudo systemctl restart octoprint