CVE-2026-105326

An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with "-" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.

This vulnerability is rated Low because exploitation requires multiple environmental conditions beyond the CUPS code flaw alone. The vulnerable mailto notifier logic is present in CUPS packages shipped in Red Hat Enterprise Linux, but practical impact on RHEL is limited: RHEL typically provides Postfix's sendmail-compatible wrapper, which does not support the traditional sendmail -C configuration option used in public proof-of-concept chains, and many systems do not install or enable an MTA for CUPS notifications. By default, cupsd listens only on the local loopback interface unless administrators explicitly configure remote access. Create-Printer-Subscription is allowed for unauthenticated clients only under the default policy when cupsd is configured to accept remote IPP; operators can reduce exposure by restricting network access to the printing service and disabling mail notifications if unused. Red Hat is tracking upstream fixes and will publish updated CUPS packages when available.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict network access to the CUPS service (port 631/tcp) to trusted hosts only, and avoid exposing cupsd to untrusted networks. If email notifications are not required, do not configure mailto subscriptions or remove/disable the mailto notifier. Ensure only a trusted mail transfer agent is installed and referenced from CUPS mailto configuration. Monitor for unexpected printer subscriptions and unusual sendmail activity from the lp user.