CVE-2025-58060

What it actually does

When AuthType is set to anything but Basic, requests containing an Authorization: Basic header bypass password verification entirely, resulting in authentication bypass for any non-Basic authentication configuration.

Why it matters to the business

Attackers can gain unauthorized access to printing services, enabling them to submit or manage print jobs, view job data, or disrupt operations without valid credentials, increasing risk of data exposure or resource abuse in environments relying on CUPS.

How an attack unfolds

An attacker identifies a CUPS server configured with non-Basic AuthType and sends HTTP requests that include an Authorization: Basic header; the server skips credential validation, granting access to protected printing functions.

How to fix it

Upgrade openprinting/cups to the version containing commit eee59dd0b55a0b11b80bda6ca437d60fee5faa09 (equivalent to 2.4.13) and restart the service; review and standardize AuthType settings across deployments.

How to confirm the fix worked

Confirm the installed CUPS version includes commit eee59dd0b55a0b11b80bda6ca437d60fee5faa09; test by sending Authorization: Basic requests against a non-Basic AuthType configuration and verify that access is denied.

Typical attack path

1. Scan for exposed CUPS instances with non-Basic AuthType configurations
2. Send crafted requests containing Authorization: Basic headers
3. Access protected endpoints and perform actions without valid credentials

How to detect it

Inspect CUPS access logs for requests that include Authorization: Basic headers succeeding against non-Basic AuthType configurations; correlate with unusual print job submissions or management actions.

What your security team should do

• Prioritize upgrade of all CUPS instances to the patched commit within the next maintenance window
• Audit authentication configurations to enforce consistent AuthType settings
• Enable detailed access logging for CUPS to support future monitoring