CVE-2026-105326: CUPS Argument Injection RCE Vulnerability

CVE-2026-105326 Overview

CVE-2026-105326 is an argument injection vulnerability [CWE-88] in the Common UNIX Printing System (CUPS). The flaw resides in the CUPS scheduler's handling of printer subscription requests that use a mailto notify-recipient-uri. The mailto notifier forwards the recipient address to the configured sendmail program without validating that the value cannot be parsed as a command-line option. An attacker able to reach the CUPS service can supply a crafted recipient value beginning with - to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.

Critical Impact

Argument injection into the sendmail invocation can lead to attacker-controlled command execution under the CUPS service account when email notifications are configured.

Affected Products

• OpenPrinting CUPS (upstream, affected versions tracked in GitHub CUPS Security Advisory GHSA-r4wf-366f-f6g3)
• Red Hat Enterprise Linux distributions of CUPS (see Red Hat Security Advisory RHSA-2026:77638)
• Downstream Linux distributions packaging the vulnerable CUPS scheduler with mailto notification support

Discovery Timeline

• 2026-10-05 - CVE CVE-2026-105326 published to NVD
• 2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-105326

Vulnerability Analysis

The vulnerability resides in the CUPS mailto notifier, which handles email-based subscription notifications. When a client submits a printer subscription with a notify-recipient-uri of the form mailto:<address>, the scheduler extracts the recipient address and passes it to the configured sendmail program. The notifier does not insert -- as an end-of-options marker and does not reject recipients starting with -. As a result, a recipient value such as -oQ/tmp/attacker or -C/path/to/config is interpreted by sendmail as a command-line option rather than an email address. Depending on the mail transfer agent in use, these options can redirect queue directories, load alternate configuration files, or trigger other sendmail behaviors. The impact chain terminates in command or file-handling behavior executed with the privileges of the CUPS service user.

Root Cause

The root cause is improper neutralization of argument delimiters in a command [CWE-88]. The mailto notifier concatenates user-controlled input into an argv array passed to sendmail without validating leading characters or using an argument separator. Fixes are tracked in CUPS commits 1244ed9 and 611d1bd.

Attack Vector

The attacker submits an IPP subscription request to the CUPS scheduler specifying a crafted mailto recipient URI. Exploitation requires that CUPS email notifications are enabled and that the attacker can authenticate or reach the IPP endpoint. The CVSS vector indicates local access with high attack complexity, reflecting the dependency on the installed MTA and CUPS network exposure. Refer to the Red Hat CVE Analysis CVE-2026-105326 for scenario constraints.

No verified public exploit code is available. See the GitHub CUPS
Security Advisory GHSA-r4wf-366f-f6g3 for technical details on the
mailto notifier argument handling.

Detection Methods for CVE-2026-105326

Indicators of Compromise

• Printer subscription requests in the CUPS access log containing notify-recipient-uri=mailto:- or any recipient value beginning with -.
• Unexpected invocations of sendmail by the CUPS parent process with argv entries that resemble sendmail flags (-o, -C, -X, -bs).
• New or unexpected files created by the CUPS service user in paths consistent with sendmail option abuse (alternate queue or log directories).

Detection Strategies

• Audit /var/log/cups/access_log and error_log for subscription-create operations with suspicious recipient URIs.
• Monitor process creation events where the parent is cupsd or cups-notifier and the child is sendmail with argv values starting with - beyond expected flags.
• Correlate IPP subscription activity from unauthenticated or unexpected source addresses with mailto notifier execution.

Monitoring Recommendations

• Enable verbose CUPS logging (LogLevel debug) during triage to capture full notify-recipient-uri values.
• Forward CUPS logs and host process telemetry to a centralized analytics platform for retention and rule-based alerting.
• Baseline normal sendmail invocation patterns on print servers and alert on deviations in argv structure.

How to Mitigate CVE-2026-105326

Immediate Actions Required

• Apply vendor-supplied CUPS updates referenced in Red Hat Security Advisory RHSA-2026:77638 and equivalent advisories for other distributions.
• Restrict network exposure of the CUPS IPP port (TCP/631) to trusted print clients using host firewalls or network ACLs.
• Review existing subscriptions and remove any with recipient URIs that begin with - or otherwise appear malformed.

Patch Information

Upstream fixes are available in CUPS commits 1244ed9 and 611d1bd, which add input validation to the mailto notifier. Distribution-specific packages are tracked in Red Hat Bug Report #2545835 and the associated errata.

Workarounds

• Disable the CUPS mailto notifier by removing or commenting out the mailto entry in /etc/cups/notifier.conf or the equivalent configuration path.
• Disable or unconfigure email notifications in cupsd.conf until patches are applied.
• Bind cupsd to the loopback interface and require authenticated local access for subscription-create operations.

# Restrict cupsd to localhost and limit subscription access
# /etc/cups/cupsd.conf
Listen localhost:631
Listen /var/run/cups/cups.sock

<Location />
  Order allow,deny
  Allow localhost
</Location>

# Remove the mailto notifier binary to prevent its invocation
chmod 0000 /usr/lib/cups/notifier/mailto
systemctl restart cups