OctoPrint's road to 2.0 has an extra stop. On October 20, 2026, maintainer Gina Häußge (foosel) published OctoPrint 2.0.0rc7 on GitHub, a seventh release candidate that was not on the schedule. The project's own announcement says the maintainer received a bug report and a security report for the 2.0 release candidates, and this release is the result. The security issue is the headline: a stored cross-site scripting (XSS) flaw in the bundled Serial Connector plugin that affects every 2.0 release candidate so far, rc1 through rc6. The release also fixes a firmware compatibility problem that matters to Prusa owners, and it asks owners of Klipper and Bambu printers to help test.
This piece sticks to what is new in rc7: the vulnerability, the firmware fix, and what testers are being asked to do next.
The Vulnerability: Script Injection Through Connection Settings
According to the release notes, the flaw is a stored XSS reachable through saved connection parameters. Specifically, OctoPrint 2.0.0rc1 up to 2.0.0rc6 are susceptible to cross-site scripting via a specially crafted default port or baudrate setting on the bundled Serial Connector plugin, supplied through the API as new defaults during a connect request. In a stored XSS, an attacker plants script content in data the application saves. The browser then runs that script later, when the application shows the saved data without escaping it properly. Unlike a reflected XSS, which needs a victim to click a crafted link, a stored payload stays in place and can fire whenever the affected part of the interface loads.
The project rates it Low severity with a CVSS score of 2.4. That rating suggests an issue with narrow exploitability rather than an emergency for every installation. Exploiting it requires sending crafted values to the API during a connection request, which is not something a casual visitor does. The project has published a GitHub Security Advisory. A CVE has been requested but had not been assigned by GitHub when the release went out. Credit for the responsible disclosure goes to GitHub user @mahn-don.
The bug's location says something about the 2.0 work. The Serial Connector is a bundled plugin in the 2.0 line, and the flaw sits in how it handles default values for settings as simple as a port name and a baud rate. Fields like these are easy to treat as harmless when someone writes the rendering logic. Catching this during a release-candidate cycle, before a stable 2.0 exists, is exactly what such a cycle is for.
Prusa Buddy Firmware and the Missing "File selected"
The second notable change is a compatibility improvement in the Serial Connector, tracked as #5469. The notes say OctoPrint now supports printer firmware that does not send a File selected message after a File opened message. They name Prusa's Buddy Firmware as an example.
That fix is relevant for anyone who manages files on the printer's own storage through OctoPrint. Serial printing relies on the firmware's replies to OctoPrint's commands, and firmware that leaves out a message the host expects is a natural source of trouble. rc7 makes the Serial Connector accept that behavior. The release notes list managing files on your printer's storage via a serial connection as a specific area for testing, which suggests the maintainer wants confirmation from people with real hardware.
The same issue number covers a core bug fix: OctoPrint now properly handles an empty print job progress. The notes say this can happen if, for some reason, the printer's job cannot be found. In practice that should mean OctoPrint no longer stumbles when a job lookup comes back empty.
The release also includes a documentation update that explains the special handling of multipart requests. Developers working against OctoPrint's API will want to read it.
What Testers Are Being Asked to Check
As the release notes put it, these are the things that should get a closer look while testing:
- Web interface behavior, using the included interface as well as any third-party clients you have available.
- Printing via a serial connection, the path classic OctoPrint setups rely on.
- Managing files on your printer's storage via a serial connection, directly related to the Buddy Firmware change.
- Migration of blocklisted serial ports and baud rates to the serial connector, entered one per line rather than comma-separated.
- The "after error" disconnected state. If your printer ends up there, the project wants to know which connector you used and what error was reported. The release notes add that the maintainer is still seeing a lot of unexplained "error" states and ask testers to take special note of this item.
- The Moonraker Connector and the Bambu Connector, installable plugins for Klipper/Moonraker-based and Bambu-based printers. The announcement labels both as work in progress.
The last item stands out. For most people OctoPrint has been a serial host, and the Moonraker and Bambu connectors point it at printers with a different kind of control path. The project is explicitly asking people with those printers to try the connectors, and that feedback will show how well the connector approach works in practice.
What It Means for Makers
If you run a stable OctoPrint 1.x release, nothing here applies to you directly. The advisory lists only 2.0.0rc1 through 2.0.0rc6 as affected. The project's own warning is blunt: do not install this release candidate if you expect a fully stable version. A release candidate can have severe bugs, and a manual downgrade to an earlier version may be necessary, possibly from the command line.
If you are already testing 2.0, upgrading to rc7 is the obvious move. Every earlier candidate carries the XSS, and staying on rc1 through rc6 means keeping a known flaw for no benefit. The low CVSS score is reassuring, but it doesn't make the fix optional for a machine you plan to keep using. If other people can reach your OctoPrint instance or its API, the case for updating is stronger.
Prusa owners who have had trouble with file handling over a serial connection on Buddy Firmware should take another look. The notes name Buddy Firmware as an example of firmware that rc7 now handles. Report what you find, because file management on printer storage is on the official test list.
Klipper and Bambu users who have never had a reason to run OctoPrint now have one, at least as testers. Try the Moonraker or Bambu Connector on a non-critical setup, and accept that a downgrade may mean some time in a terminal.
Bottom Line
An unplanned release candidate is not necessarily a bad sign. Here a security researcher reported a flaw, the maintainer patched it, published an advisory and noted that a CVE had been requested, and the same release added support for firmware like Prusa's Buddy Firmware. Testers should upgrade. Everyone else should stay on stable and wait for 2.0 final.
