Octopus Deploy vulnerabilities

CVEs per yearBy the year they were published

1. 20218
2. 202224
3. 202314
4. 20248
5. 20257
6. 202619

Newest CVEs

• CVE-2026-118426

  In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group…

  Octopus Deploy · Octopus Server

  Medium5.3
• CVE-2026-12887

  In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes…

  Octopus Deploy · Octopus Server

  Medium5.1
• CVE-2026-117466

  In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.

  Octopus Deploy · Octopus Server

  High8.6
• CVE-2026-117341

  In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space,…

  Octopus Deploy · Octopus Server

  High7.7
• CVE-2026-116870

  In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably…

  Octopus Deploy · Octopus Server

  High8.7
• CVE-2026-102488

  In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment…

  Octopus Deploy · Octopus Server

  High8.7
• CVE-2026-102478

  In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in…

  Octopus Deploy · Octopus Server

  High8.7
• CVE-2026-78210

  In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the…

  Octopus Deploy · Octopus Server

  High7.1
• CVE-2026-101169

  In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for…

  Octopus Deploy · Octopus Server

  High8.7
• CVE-2026-92355

  In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary…

  Octopus Deploy · Octopus Server

  High8.7