---
id: CVE-2022-2822
aliases:
  - GHSA-5w5x-q9p5-9qg3
  - PYSEC-2026-887
title: OctoPrint does not have rate limiting on the login page
summary: OctoPrint does not have rate limiting on the login page
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
vendor: octoprint
product: octoprint
ecosystem: pip
affected:
  - octoprint <= 1.7.3
published: '2022-08-16'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-5w5x-q9p5-9qg3'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-2822'
  - url: >-
      https://github.com/octoprint/octoprint/commit/82c892ba40b3741d1b7711d949e56af64f5bc2de
  - url: 'https://github.com/octoprint/octoprint'
  - url: 'https://huntr.dev/bounties/6369f355-e6ef-4469-af75-0f6ff00cde3d'
tags:
  - osv
  - pip
epss: 0.00849
epssPercentile: 0.5658
ingestedAt: '2026-07-08T18:25:46.225Z'
---

## Overview

OctoPrint 1.7.3 and prior does not have rate limiting on the login page, making it possible for attackers to attempt brute force attacks. The severity of this issue is limited by OctoPrint normally running in a restricted LAN. The `devel` and `maintenance` branches of the repository have a fix that limits the rate of failed login attempts.

## Affected packages

- `octoprint <= 1.7.3`

## Remediation

Refer to the advisory for the patched release.