CVE-2026-91102

Executive Summary

CVE-2026-91102 is a cluster of externally reported vulnerabilities in HPLIP, HP's Linux Imaging and Printing driver stack, which HP describes as affecting "several software components" that could enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. The CWE classification assigned to this record is CWE-78 (Improper Neutralization of Special Elements used in an OS Command, i.e., OS command injection), indicating an input-handling flaw where attacker-controlled data reaches a command execution primitive. Any host running an unpatched HPLIP installation—commonly Linux workstations, print servers, and CUPS-integrated environments—is potentially in scope, and the unauthenticated remote vector implied by the vendor's "remotely exploitable" phrasing makes this a high-priority exposure for enterprise fleets. No CVSS score, EPSS score, public PoC, or Nuclei template is currently available, so risk must be assessed from the vulnerability class and affected product surface rather than from exploit-in-the-wild telemetry.

Technical Analysis

The authoritative data for this record is limited to the HP advisory summary and the CWE assignment. The HP text states that multiple externally reported vulnerabilities were identified and remediated within HPLIP, affecting several software components, with impact classes spanning remote code execution, privilege escalation, denial of service, information disclosure, and unauthorized file modification. The record is classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').

CWE-78 describes the classic failure mode in which externally influenced input is incorporated into a string that is subsequently passed to a shell or process-spawning API without sufficient neutralization of shell metacharacters (;, |, &, $(), backticks, newline, and similar). When such a string reaches system(), popen(), exec*() via a shell, or an equivalent primitive, the attacker gains the ability to append or inject their own command, which then executes with the privileges of the invoking process. In a printing subsystem, that invoking process is frequently a privileged daemon or a setuid helper, which is precisely what makes the privilege-escalation and remote-code-execution impact classes plausible for this cluster.

Because the provided NVD description does not name affected binaries, scripts, modules, D-Bus interface methods, CUPS back-end handlers, or configuration parameters, this report deliberately does not attribute the flaw to a specific HPLIP executable, Python module, or socket. Based on the vulnerability class and product architecture, the plausible attack surface consists of the components HPLIP exposes to untrusted input:

• Network-facing print services — HPLIP integrates with CUPS and with HP network printers. Any component that parses device-supplied or network-supplied strings (device URIs, printer capability responses, SNMP/PJL status data) and forwards them into a command context is a candidate surface.
• Local privileged helpers — HPLIP ships helpers that run with elevated privileges to configure devices, manage PPDs, or invoke external utilities. A missing sanitization step in such a helper converts a local, low-privileged trigger into root-level command execution.
• Configuration and file handling — The "unauthorized file modification" impact class in the advisory implies that attacker-influenced paths or filenames may be consumed by a component that writes or rewrites files, potentially combined with the command-injection vector.

The simultaneous presence of RCE, privilege escalation, DoS, information disclosure, and file-modification impacts is consistent with a multi-finding advisory rather than a single defect: HP's wording ("multiple externally reported vulnerabilities," "several software components") indicates the CVE aggregates a family of related defects. Each constituent defect should be treated as separately exploitable, but all share the same root cause discipline expectation — insufficient validation of externally supplied data before it reaches a sensitive sink.

The precise injection sink cannot be determined from the available data. What can be stated with confidence is the mechanism class: attacker-controlled input → insufficient neutralization → OS command construction → execution in the context of the HPLIP process. This is the attack primitive around which all detection and mitigation guidance below is built.

Exploitation Scenarios

Important constraint: No public PoC, exploit code, or Nuclei template exists for this CVE, and the NVD description does not disclose implementation-level detail. The following chain is therefore inferred at the vulnerability-class level from CWE-78 and the vendor's stated impact classes. No specific function names, endpoints, or parameters are invented or asserted.

1) Reconnaissance / target identification An attacker scans for hosts exposing printing services commonly associated with HPLIP deployments — CUPS on TCP/631 is the canonical indicator, with IPP and mDNS/Bonjour discovery traffic (UDP/5353) as secondary beacons. Fingerprinting the presence of HPLIP specifically can be done via banner and page content inspection, printer-model identification, and observing CUPS queue metadata. Hosts that are Linux workstations with HPLIP installed but no network-exposed print daemon remain in scope for the local privilege-escalation variant of the CWE-78 class.

2) Trigger of the specific flaw class (OS command injection) The trigger requires delivering input that reaches a command-construction sink without neutralization. Depending on which constituent component is targeted, the delivery channel is one of:

• Network channel — crafted data embedded in a print job, in a device URI or attribute supplied over IPP/CUPS, or in a response from a malicious/compromised printer that the HPLIP client parses.
• Local channel — arguments or environment data supplied to a privileged HPLIP helper by a local unprivileged user.

The defining characteristic of the flaw class is that a metacharacter or argument boundary is not properly handled, so the injected portion of the string is interpreted by the shell or process launcher as a separate command rather than as inert data.

3) Payload / execution method (vulnerability-class level) The payload is a shell command appended to or embedded within the otherwise-legitimate value. Execution occurs in the security context of the HPLIP component that performs the command construction — potentially root for setuid helpers or daemon-owned processes. No specific payload syntax is asserted here because the exact concatenation primitive is unknown.

4) Post-exploitation impact The vendor's own impact enumeration defines the post-compromise envelope: remote code execution (arbitrary commands as the service identity), privilege escalation (from unprivileged local user to a more privileged context), denial of service (crash of print services or the host), information disclosure (reading of files reachable by the service identity, which may include credentials or print spool contents), and unauthorized file modification (tampering with configuration, spool data, or system files).

Chaining is plausible: a local information-disclosure or file-modification primitive could be combined with the command-injection primitive to achieve persistence, or a network-facing injection could be used to pivot into an internal network from a print server positioned on a trusted segment.

Impact Assessment

No official CVSS score was supplied (CVSS Score: N/A). The vector included in the metadata is an estimated CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H based on the vendor's description of remote exploitability and high-impact outcomes (RCE, privilege escalation, file modification). It must not be treated as authoritative — the record currently carries no published CVSS.

Business impact:

• Confidentiality (High, estimated): information-disclosure impact is explicitly named by the vendor; print infrastructure frequently processes sensitive documents and holds credentials for network devices.
• Integrity (High, estimated): "unauthorized file modification" is explicitly named; configuration tampering on a fleet of managed printers is operationally significant.
• Availability (High, estimated): denial-of-service impact is explicitly named; loss of printing is a business-continuity issue in regulated and paper-dependent workflows (healthcare, legal, logistics).
• Privilege escalation: local users on multi-tenant or shared Linux endpoints could elevate within the host, expanding the blast radius beyond the printing subsystem.

Blast radius: Every Linux endpoint or server with an unpatched HPLIP installation. Because HPLIP is frequently installed by default in desktop Linux distributions and is common on print servers, the population of affected hosts is large even though only a subset will be network-exposed. A compromised print server positioned in a corporate VLAN is a high-value lateral-movement staging point.

Exploitability: EPSS is not yet scored by FIRST.org, and no KEV listing exists. Absence of EPSS/KEV data at this time does not indicate exploitability is low — it indicates the record is new or not yet analyzed. The CWE-78 class is historically one of the most reliably exploitable web/OS vulnerability families, so defenders should assume exploitation is feasible once details propagate.

Detection Guidance

The rules below target the vulnerability class (OS command injection in a printing subsystem) rather than a specific known payload, because no PoC or payload signature is public. They are tuned for anomalies in process lineage and child-process behavior around HPLIP/CUPS.

Sigma Rule

title: Potential OS Command Injection via HPLIP / CUPS Processes
id: 3f9c2a71-6b4e-4d1a-9f2c-hplip91102
status: experimental
description: Detects suspicious shell or interpreter child processes spawned by HPLIP/CUPS-related parent processes, consistent with CWE-78 OS command injection in the printing stack.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91102
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '/hp-*'
      - '/hplip*'
      - '/cupsd'
      - '/cups-*'
      - '/python3'
  selection_parent_cmd:
    ParentCommandLine|contains:
      - 'hplip'
      - 'hp-'
      - 'cups'
  selection_child_shell:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/nc'
      - '/ncat'
      - '/socat'
      - '/curl'
      - '/wget'
  filter_known_good:
    CommandLine|contains:
      - 'hp-info'
      - 'hp-check'
  condition: (selection_parent or selection_parent_cmd) and selection_child_shell and not filter_known_good
falsepositives:
  - Legitimate HPLIP setup scripts invoking shell utilities during installation
  - Package manager post-install scripts
level: high
tags:
  - attack.t1190
  - attack.execution
  - cve.2026-91102

YARA Rule

rule CVE_2026_91102_HPLIP_CmdInjection_Artifact
{
    meta:
        author = "valtersit.com"
        description = "Heuristic detection of shell-metacharacter injection markers in HPLIP configuration, spool, or helper artifacts (CWE-78 class)."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91102"
        date = "2026-01-01"
        severity = "high"

    strings:
        $s1 = "hplip" ascii nocase
        $s2 = "hp-setup" ascii nocase
        $s3 = "cups" ascii nocase

        $m1 = ";sh " ascii
        $m2 = "&&sh " ascii
        $m3 = "|sh" ascii
        $m4 = "$(" ascii
        $m5 = "`" ascii
        $m6 = "/bin/sh -c" ascii
        $m7 = "curl http" ascii nocase
        $m8 = "wget http" ascii nocase
        $m9 = "base64 -d" ascii

    condition:
        uint32(0) != 0x89504E47 and
        (any of ($s1, $s2, $s3)) and
        2 of ($m*)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET 631 (msg:"CVE-2026-91102 HPLIP/CUPS suspected OS command injection markers in IPP traffic"; flow:established,to_server; content:"IPP"; nocase; content:"|3b|"; content:"sh"; distance:0; pcre:"/(;|&&|\|)\s*(sh|bash|nc|wget|curl)\b/"; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-admin; sid:2026009110; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.name : ("hp-*", "cupsd", "cups-*", "python3") and
  process.parent.command_line : ("*hplip*", "*hp-*", "*cups*") and
  process.name : ("sh", "bash", "dash", "zsh", "nc", "ncat", "socat", "curl", "wget")

Splunk SPL Query

index=linux sourcetype=linux_audit OR sourcetype=sysmon_linux
| eval pcmd=coalesce(parent_process, parent_command_line)
| eval ccmd=coalesce(process_name, process_path)
| where match(lower(pcmd), "(hplip|hp-|cups)") AND match(lower(ccmd), "(/sh|/bash|/dash|/zsh|/nc|/ncat|/socat|/curl|/wget)$")
| stats count min(_time) as first_seen max(_time) as last_seen values(command_line) as commands by host, user, pcmd
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="hplip,cve-2026-91102,">
  <rule id="100210" level="12">
    <if_sid>5501</if_sid>
    <field name="parent_command">hplip|hp-|cups</field>
    <field name="command">/bin/sh|/bin/bash|/usr/bin/nc|/usr/bin/curl|/usr/bin/wget</field>
    <description>CVE-2026-91102: Possible OS command injection - shell/interpreter spawned from HPLIP/CUPS context</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>os_command_injection,</group>
  </rule>

  <rule id="100211" level="10">
    <if_sid>5501</if_sid>
    <field name="command">hp-setup|hp-info|hp-plugin</field>
    <field name="parent_command">sh|bash</field>
    <description>CVE-2026-91102: Suspicious shell wrapper executing HPLIP tooling</description>
    <group>hplip_suspicious,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

HP states the vulnerabilities have been "identified and remediated," but no advisory number, patched release version, or changelog reference was supplied in the source data. Until HP publishes a versioned advisory, treat all HPLIP installations as potentially vulnerable.

1) Immediate mitigations (compensating controls):

• Restrict network exposure of CUPS and IPP (TCP/631) to trusted management VLANs only; disable printing services on hosts that do not require them.
• Remove or disable unnecessary privileged HPLIP helpers and setuid bits on components not in active use.
• Apply mandatory access control (SELinux or AppArmor confinement) to HPLIP/CUPS daemons and helpers to constrain what a successful injection can execute.
• Monitor for anomalous child-process creation from HPLIP and CUPS parent processes using the Sigma/Wazuh rules above; alert on any shell or network-utility child spawned by these parents.
• Enforce least privilege for local users on shared Linux endpoints to blunt the privilege-escalation variant.

2) Patch / upgrade steps:

• Monitor the vendor's security advisory channels and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-91102) for the patched HPLIP release identifier.
• Once a patched version is published: inventory affected hosts (dpkg -l | grep hplip / rpm -qa | grep hplip or equivalent), test the updated package in a staging environment with printing workflows exercised, then roll out fleet-wide via configuration management.
• Re-verify that helpers retain the correct file permissions after upgrade and that no residual world-writable or setuid artifacts remain.
• Because the endpoint here is UNPATCHED with 0/4 patch confidence, do not rely on "latest version" claims without matching a specific vendor advisory to a specific version.

3) Long-term hardening:

• Adopt a software-bill-of-materials and vulnerability-management process that tracks the HPLIP stack as a first-class dependency alongside CUPS and Python.
• Enforce seccomp/AppArmor/SELinux profiles that deny shell execution from print daemons at the kernel level — this neutralizes the entire CWE-78 class regardless of individual defect discovery.
• Segment printers onto a dedicated network zone with strict egress filtering to prevent use of a compromised print host as a pivot.
• Subscribe to HP's security notification feed and the CISA KEV catalog; although this CVE is not currently KEV-listed, KEV status can change following public exploitation.

References

1. NVD — CVE-2026-91102: https://nvd.nist.gov/vuln/detail/CVE-2026-91102
2. HP Product Security (advisory portal for HPLIP remediation details): https://support.hp.com/us-en/security-bulletins
3. CWE-78 — Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog (check for future KEV addition): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild status: No evidence of exploit-in-the-wild activity, no attributed threat actor campaign, and no public PoC, exploit code, or Nuclei template is associated with CVE-2026-91102 in the data provided. Patch confidence is 0/4 (no patch evidence from any tracked source). Defenders should monitor the NVD entry and HP advisory portal for updates, as the CWE-78 classification and remote-impact description make this a strong candidate for weaponization once technical details are public.