CVE-2026-87876: CUPS Scheduler Auth Bypass Vulnerability

CVE-2026-87876 Overview

CVE-2026-87876 affects the CUPS (Common UNIX Printing System) scheduler, where two case-insensitive comparisons on request-derived usernames occur outside the main authorization path. The flaw impacts printer Access Control List (ACL) validation and private-attribute filtering. In certain configurations, an authenticated adjacent-network attacker can bypass username-based access controls by supplying usernames that differ only in letter case from authorized principals. The issue is tracked under CWE-178: Improper Handling of Case Sensitivity and was addressed by the OpenPrinting project.

Critical Impact
Attackers on an adjacent network with low privileges can bypass printer ACL checks and access private IPP attributes that should be restricted to specific users.

Affected Products

OpenPrinting CUPS scheduler (cupsd) prior to the patched commits
Red Hat distributions shipping vulnerable CUPS builds
Linux and UNIX systems using CUPS for print service management

Discovery Timeline

2026-09-09 - CVE-2026-87876 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87876

Vulnerability Analysis

The defect resides in the CUPS scheduler's handling of usernames derived from Internet Printing Protocol (IPP) requests. Two code paths, printer ACL validation and private-attribute filtering, use case-insensitive string comparisons when checking whether a requester matches an authorized username. The main authorization path uses case-sensitive comparisons on UNIX systems, creating an inconsistency between authorization decisions and downstream access checks.

An attacker can submit a print request or IPP query supplying a username whose case differs from a legitimate user (for example, ALICE instead of alice). The primary authenticator may reject or treat the identity distinctly, but the ACL and attribute-filter routines interpret both strings as equivalent. This mismatch allows unauthorized identities to satisfy per-printer user allow/deny lists or to view job attributes marked private to another user.

Root Cause

Inconsistent username normalization across the scheduler is the root cause. Files including scheduler/client.h, scheduler/cupsd.h, scheduler/ipp.c, and scheduler/policy.c did not uniformly resolve usernames through the system password database (struct passwd) before comparison. The upstream fix introduces pw (password entry) lookups so policy and quota comparisons use the canonical username returned by the operating system.

Attack Vector

Exploitation requires adjacent-network access to the CUPS scheduler port (IPP, TCP/631) and low-privilege authentication. User interaction is required, and the impact is limited to confidentiality. There is no known public exploit and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

// Patch excerpt from scheduler/ipp.c - resolves username via passwd database
   char		username[33],		/* Username */
 		*name;			/* Current user name */
   cupsd_quota_t	*q;			/* Quota data */
+  struct passwd	*pw;			/* User password data */
 #ifdef HAVE_MBR_UID_TO_UUID
  /*
   * Use Apple membership APIs which require that all names represent
// Source: https://github.com/OpenPrinting/cups/commit/f56844dbe4a54a9f8e1aeb3b913fbee614156bdb

Detection Methods for CVE-2026-87876

Indicators of Compromise

IPP requests to cupsd on TCP/631 where the requesting-user-name attribute differs in letter case from established local account names.
CUPS access log entries (/var/log/cups/access_log) showing successful operations under usernames that do not match /etc/passwd casing.
Job attribute queries returning private data for principals other than the job owner.

Detection Strategies

Compare requesting-user-name values against canonical usernames from the system password database and flag any case-mismatched successful operations.
Baseline expected IPP client identities per printer queue and alert on deviations that still receive successful-ok responses.
Correlate CUPS error and access logs with authentication events to spot policy decisions inconsistent with the authenticated principal.

Monitoring Recommendations

Enable verbose CUPS logging with LogLevel debug on hosts running the scheduler and forward logs to a central Security Information and Event Management (SIEM) platform.
Monitor TCP/631 traffic patterns from adjacent networks, particularly IPP Get-Job-Attributes and Create-Job operations issued by low-privilege users.
Track version and patch state of the cups package across the fleet to identify unpatched hosts.

How to Mitigate CVE-2026-87876

Immediate Actions Required

Apply the patched CUPS build from your Linux distribution as soon as vendor updates are available.
Restrict cupsd network exposure to trusted management networks using host firewalls or the Listen directive in cupsd.conf.
Review per-printer RequireUser and AllowUser policies for reliance on case-sensitive matching.

Patch Information

The upstream fix is delivered through OpenPrinting CUPS commits 88e67c00 and f56844db, which standardize username comparisons for policies and quotas by resolving requester names through the system password database. See the OpenPrinting CUPS Security Advisory GHSA-r8jp-q6fh-g5r2 and the Red Hat CVE-2026-87876 Advisory for distribution-specific package versions.

Workarounds

Bind cupsd to localhost only where remote printing is not required, using Listen localhost:631 in /etc/cups/cupsd.conf.
Remove reliance on username-based printer ACLs and enforce access at the network or authentication layer instead.
Disable printer sharing (Browsing Off and BrowseLocalProtocols none) on hosts that do not need to publish queues.

bash

# Configuration example - restrict cupsd to loopback and disable browsing
sudo sed -i 's/^Listen .*/Listen localhost:631/' /etc/cups/cupsd.conf
echo 'Browsing Off' | sudo tee -a /etc/cups/cupsd.conf
echo 'BrowseLocalProtocols none' | sudo tee -a /etc/cups/cupsd.conf
sudo systemctl restart cups