Octopus Deploy vulnerabilities
80 CVEs and advisories name Octopus Deploy as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-118426In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user…
- CVE-2026-12887In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the…
- CVE-2026-117466In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.
- CVE-2026-117341In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log.
- CVE-2026-116870In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently.
- CVE-2026-102488In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obta
- CVE-2026-102478In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access
- CVE-2026-78210In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without
- CVE-2026-101169In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafte
- CVE-2026-92355In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to
- CVE-2026-91778In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the
- CVE-2026-12878In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.
- CVE-2026-14163In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment va
- CVE-2026-12702In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deploymen
- CVE-2026-8296In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts.
- CVE-2026-4881In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server
- CVE-2026-3237In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expi
- CVE-2026-3236In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key ha
- CVE-2026-0704In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint.
- CVE-2025-0539In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentic
- CVE-2025-0588In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses.
- CVE-2025-0513In affected versions of Octopus Server error messages were handled unsafely on the error page.
- CVE-2025-0526In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint.
- CVE-2025-0525In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a target file.
- CVE-2025-0589In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated
- CVE-2024-12226In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in cle
- CVE-2024-1656Affected versions of Octopus Server had a weak content security policy.
- CVE-2024-7998In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifesp
- CVE-2024-6972In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in c
- CVE-2024-4811In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restricted project artifac